Easy hunts: RuntimeBroker.exe running from %LOCALAPPDATA%\Microsoft\RuntimeBrokers, or a vshost*.exe with a .config next to it on a box that is not a dev machine. And if your users do not build code, MSBuild does not need to run there.
https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/
Prevent MSBuild from running where it is not needed with app control, free with https://MagicSword.io: https://magicsword.io
Unit 42Blinder Tunnel Campaign Targets Iraqi InfrastructureAnalysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure.