Windows msbuild.exe Network Connection to Web Ports (80/443) with Initiated Session

title: Windows msbuild.exe Network Connection to Web Ports (80/443) with Initiated Session
id: cad4ce6a-0544-4699-aa85-da58210f0d56
status: test
description: This rule flags Windows systems where msbuild.exe is observed making an initiated network connection to destinations on ports 80 or 443. Attackers may use legitimate build tooling to stage or communicate during execution, so outbound web-port connections from msbuild.exe can be a high-signal anomaly. The detection relies on network connection telemetry including process image path endings, destination port, and an initiated-connection indicator.
references:
  - https://www.blackhillsinfosec.com/my-first-joyride-with-silenttrinity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml
author: Kiran kumar s, oscd.community, Huntrule Team
date: 2020-10-11
modified: 2022-10-05
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \msbuild.exe
  filter:
    DestinationPort:
      - 80
      - 443
    Initiated: "true"
  condition: selection and filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 50e54b8d-ad73-43f8-96a1-5191685b17a4
    type: derived