Windows msbuild.exe Network Connections to Ports 80/443
Alerts on initiated outbound 80/443 connections from msbuild.exe on Windows.
- Product
- windows
- Category
- network_connection
- Author
- Kiran kumar s, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-11
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies instances where msbuild.exe initiates outbound network connections to destination ports 80 or 443. Attackers may abuse msbuild to download or stage additional components using common web ports, blending into normal outbound traffic. Telemetry relies on process/network connection events that include the connecting image path, destination port, and whether the connection was initiated by the host.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows msbuild.exe Network Connections to Ports 80/443
id: cad4ce6a-0544-4699-aa85-da58210f0d56
status: test
description: Identifies instances where msbuild.exe initiates outbound network connections to destination ports 80 or 443. Attackers may abuse msbuild to download or stage additional components using common web ports, blending into normal outbound traffic. Telemetry relies on process/network connection events that include the connecting image path, destination port, and whether the connection was initiated by the host.
references:
- https://www.blackhillsinfosec.com/my-first-joyride-with-silenttrinity/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml
author: Kiran kumar s, oscd.community, Huntrule Team
date: 2020-10-11
modified: 2022-10-05
tags:
- attack.execution
- attack.stealth
- attack.t1127.001
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \msbuild.exe
filter:
DestinationPort:
- 80
- 443
Initiated: "true"
condition: selection and filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 50e54b8d-ad73-43f8-96a1-5191685b17a4
type: derived