Not tracked: Microsoft's signed vshost.exe / vshost32.exe, renamed RuntimeBroker.exe, plus a .exe.config AppDomainManager hijack (with ETW turned off) to load RuntimeBroker.dll and Blackwood.dll. It is .config-based, not search order, so maybe not a HijackLibs fit, but it is worth tracking somewhere.
XFEDI
ActivityPubConversation
Easy hunts: RuntimeBroker.exe running from %LOCALAPPDATA%\Microsoft\RuntimeBrokers, or a vshost*.exe with a .config next to it on a box that is not a dev machine. And if your users do not build code, MSBuild does not need to run there.
https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/
Prevent MSBuild from running where it is not needed with app control, free with https://MagicSword.io: https://magicsword.io
Unit 42Blinder Tunnel Campaign Targets Iraqi InfrastructureAnalysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure.