title: MSBuild (T1127.001)
id: df00tech-t1127-001
status: experimental
description: "Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations. Adversaries can abuse MSBuild to proxy execution of malicious code via the inline task capability introduced in .NET 4, which allows C# or Visual Basic code to be inserted into an XML project file. MSBuild will compile and execute the inline task. Because MSBuild.exe is a signed Microsoft binary, this technique can execute arbitrary code and bypass application control defenses configured to allow MSBuild.exe execution. Threat actors including PlugX malware and the Empire framework have used this technique to load shellcode and proxy malicious execution."
references:
  - https://attack.mitre.org/techniques/T1127/001/
  - https://df00tech.com/detections/T1127.001
author: df00tech
date: 2026/04/18
tags:
  - attack.t1127.001
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  category: process_creation
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - "Legitimate software builds initiated from PowerShell or cmd.exe wrappers in CI/CD pipelines (e.g., Azure DevOps agents, GitHub Actions runners, Jenkins agents running on Windows)"
  - Visual Studio extensions and IDE tooling that invoke MSBuild programmatically from non-standard parent contexts
  - ".NET SDK tooling (dotnet.exe) that shells out to MSBuild.exe during restore, build, or publish operations"
  - Developer workstations where engineers invoke MSBuild manually from terminals for testing build scripts in temp directories
  - "Third-party installers (e.g., Chocolatey packages, software installers) that compile .NET components during installation"
level: high