tfMITRE ATT&CK sub-technique

MSBuild T1127.001

sub-technique of T1127 Trusted Developer Utilities Proxy Execution

Tactics: Execution, Stealth
Platform: Windows
Version: 2.0
Created: 27 March 2020
Last modified: 12 May 2026
Contributors: @ionstorm; Carrie Roberts, @OrOneEqualsOne

Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

MSBuild MITRE reference T1127.001

Top 17%of all ATT&CK techniques for number of campaigns

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

FrankensteinC0001 ↗

During Frankenstein, the threat actors used MSbuild to execute an actor-created file.1

2019

Operation AkaiRyūC0060 ↗

During Operation AkaiRyū, MirrorFace used MSBuild to compile and execute its FaceXInjector injection tool.1

2004

All 2 campaigns for this technique

Offense vs defense T1127.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 4

first rule: 2020 Q4 · 1 of 2 campaigns plotted (Operation AkaiRyū (dated 2004) falls before the 2017 window)

MSBuild detection strategy DET0556

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain detection strategy for T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild (Windows)

Enterprise

1 platform

AN1535 · Windows

MSBuild.exe is invoked outside expected developer/build contexts or with anomalous arguments (e.g., non-canonical paths, remote shares, Base64/obfuscated property values). Within a short window, it (a) spawns high-risk LOLBins/script interpreters, (b) writes new PE/DLL/script artifacts into user-writable paths and executes them, (c) loads unsigned/user-writable modules, (d) performs memory injection/thread creation into other processes, and/or (e) initiates outbound network connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process ModificationDC0020	WinEventLog:Sysmon	EventCode=8
Script ExecutionDC0029	EDR:AMSI	Malicious inline C#/script blobs embedded in MSBuild projects if intercepted by AMSI-aware loaders (rare but possible via chained LOLBins)
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process MetadataDC0034	WinEventLog:Microsoft-Windows-CodeIntegrity/Operational	Unsigned/invalid signature modules or images loaded by msbuild.exe or its children
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window between msbuild.exe start, payload write, suspicious child spawn, and network (e.g., 0–30 minutes).
DeveloperHosts	Tag/allowlist known developer or CI/CD hosts to reduce noise.
SuspiciousChildList	High-risk children (powershell.exe, rundll32.exe, regsvr32.exe, cmd.exe, wscript.exe, mshta.exe) spawned by msbuild.exe.
RarePathRegex	Regex of user-writable or atypical paths (e.g., %TEMP%, %APPDATA%, OneDrive sync dirs) used to drop payloads.
UnsignedOrInvalidSignatureOnly	Tighten alerting to cases with invalid or missing signatures on modules/children.
NetworkReputationThreshold	Minimum rarity/risk score for external destinations to alert.
BehaviorRiskScoreThreshold	Numeric threshold for fused, scored correlation (e.g., ≥70/100 triggers an alert).

1 analytic

Trusted developer utilities such as MSBuild may be leveraged to run malicious code with elevated privileges. This analytic looks for any instances of msbuild.exe, which will execute any C# code placed within a given XML document; and msxsl.exe, which processes xsl transformation specifications for XML files and will execute a variaty of scripting languages contained within the XSL file. Both of these executables are rarely used outside of Visual Studio.

TypeTTPCoverageHighSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	image_path

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (
  (exe="C:\Program Files (x86)\Microsoft Visual Studio\*\bin\MSBuild.exe" OR exe="C:\Windows\Microsoft.NET\Framework*\msbuild.exe" OR exe="C:\users\*\appdata\roaming\microsoft\msxsl.exe") AND
  image_path!="*Microsoft Visual Studio*")
output target_processes

Looks for all instances of msbuild.exe or msxsl.exe

(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Program Files (x86)\\Microsoft Visual Studio\\*\\bin\\MSBuild.exe" OR Image="C:\\Windows\\Microsoft.NET\\Framework*\\msbuild.exe" OR Image="C:\\users\\*\\appdata\\roaming\\microsoft\\msxsl.exe") ParentImage!="*\\Microsoft Visual Studio*")

Looks for all instances of msbuild.exe or msxsl.exe

norm_id=WindowsSysmon event_id=1 (image IN ["C:\Program Files (x86)\Microsoft Visual Studio\*\bin\MSBuild.exe", "C:\Windows\Microsoft.NET\Framework*\msbuild.exe", "C:\Users\*\appdata\roaming\microsoft\msxsl.exe") -parent_image="*\Microsoft Visual Studio*")

Disable or Remove Feature or ProgramM1042

MSBuild.exe may not be necessary within an environment and should be removed if not being used.

Execution PreventionM1038

Use application control configured to block execution of msbuild.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the msbuild.exe application and to prevent abuse.

Tests2Executorscmd 2Need elevation0 of 2Have prerequisites2Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

MSBuild Bypass Using Inline Tasks (C#)

windows

cmd

—

Executes the code in a project file using msbuild.exe. The default C# project example file (T1127.001.csproj) will simply print "Hello From a Code Fragment" and "Hello From a Class." to the screen.

Input arguments

Name	Type	Default	Description
filename	path	PathToAtomicsFolder\T1127.001\src\T1127.001.csproj	Location of the project file
msbuildname	path	msbuild.exe	Default name of MSBuild
msbuildpath	path	C:\Windows\Microsoft.NET\Framework\v4.0.30319	Default location of MSBuild

Attack command

#{msbuildpath}\#{msbuildname} "#{filename}"

Prerequisite

Project file must exist on disk at specified location (#{filename})

Check

if (Test-Path "#{filename}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{filename}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127.001/src/T1127.001.csproj" -OutFile "#{filename}"

GUID9bc9e29f-5db0-4baf-b1e4-f216343f4e22

MSBuild Bypass Using Inline Tasks (VB)

windows

cmd

—

Executes the code in a project file using msbuild.exe. The default Visual Basic example file (vb.xml) will simply print "Hello from a Visual Basic inline task!" to the screen.

Input arguments

Name	Type	Default	Description
filename	path	PathToAtomicsFolder\T1127.001\src\vb.xml	Location of the project file
msbuildname	path	msbuild.exe	Default name of MSBuild
msbuildpath	path	C:\Windows\Microsoft.NET\Framework\v4.0.30319	Default location of MSBuild

Attack command

#{msbuildpath}\#{msbuildname} "#{filename}"

Prerequisite

Project file must exist on disk at specified location (#{filename})

Check

if (Test-Path "#{filename}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{filename}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127.001/src/vb.xml" -OutFile "#{filename}"

GUID0af5c091-1376-4211-8744-315d6e551451

Tests from Atomic Red Team (MIT licence) · technique definition

MSBuild detections T1127.001

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs