Windows msbuild.exe Network Connections to Ports 80/443

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127.001MSBuild
Persistence
Priv Esc
Defense Evasion
- T1127.001MSBuild
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies instances where msbuild.exe initiates outbound network connections to destination ports 80 or 443. Attackers may abuse msbuild to download or stage additional components using common web ports, blending into normal outbound traffic. Telemetry relies on process/network connection events that include the connecting image path, destination port, and whether the connection was initiated by the host.

Reporting behind it

Related detections7 linkedT1127.001 — drag to rearrange

Proxy Execution via MSBuild Running Inline Task XML

MSBuild Executing Non-Project File or Remote Payload

Antivirus Check and Remote Loader Retrieval in LNK Command Chain

Suspicious MSBuild Execution From Office or Archive Extraction Context (via process_creation)

Suspicious MSBuild Execution from Writable Directory (via process_creation)

In-Memory MSBuild Proxy Execution of a Project From a User-Writable Path (via process_creation)

Suspicious MSBuild LOLBin Spawning Script Interpreter (via process_creation)

Windows msbuild.exe Network Connections to Ports 80/443

Pivot detection · T1127.001 · 7 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-msbuild-exe-network-connection-to-web-ports-80-443-with-initiated-sessio-50e54b8d

title: Windows msbuild.exe Network Connections to Ports 80/443
id: cad4ce6a-0544-4699-aa85-da58210f0d56
status: test
description: Identifies instances where msbuild.exe initiates outbound network connections to destination ports 80 or 443. Attackers may abuse msbuild to download or stage additional components using common web ports, blending into normal outbound traffic. Telemetry relies on process/network connection events that include the connecting image path, destination port, and whether the connection was initiated by the host.
references:
  - https://www.blackhillsinfosec.com/my-first-joyride-with-silenttrinity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml
author: Kiran kumar s, oscd.community, Huntrule Team
date: 2020-10-11
modified: 2022-10-05
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \msbuild.exe
  filter:
    DestinationPort:
      - 80
      - 443
    Initiated: "true"
  condition: selection and filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 50e54b8d-ad73-43f8-96a1-5191685b17a4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL