Remote profile

Easy hunts: RuntimeBroker.exe running from %LOCALAPPDATA%\Microsoft\RuntimeBrokers, or a vshost*.exe with a .config next to it on a box that is not a dev machine. And if your users do not build code, MSBuild does not need to run there.

https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/

Prevent MSBuild from running where it is not needed with app control, free with https://MagicSword.io: https://magicsword.io

#ThreatHunting #LOLBAS #DFIR

Not tracked: Microsoft's signed vshost.exe / vshost32.exe, renamed RuntimeBroker.exe, plus a .exe.config AppDomainManager hijack (with ETW turned off) to load RuntimeBroker.dll and Blackwood.dll. It is .config-based, not search order, so maybe not a HijackLibs fit, but it is worth tracking somewhere.

Unit 42's Blinder Tunnel write-up reads like a LOL checklist.

Fake Dubai Airports dev job, a "coding challenge" Visual Studio project, and MSBuild runs the payload in the background while the target is still reading the README.

Already tracked:
MSBuild running .csproj tasks, on LOLBAS: https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
Chisel for the tunnel (wrapped in-memory as "Blackwood"), on LOTTunnels: https://lottunnels.github.io/lottunnels/Binaries/chisel/