Techniques › T1127 › T1127.001
T1127.001 MSBuild
stealth · execution — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1127.001
0
KEV CVEs mapped here
<p>Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.</p><p>Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0556 Behavior-chain detection strategy for T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild (Windows) v1.0
AN1535 WindowsMSBuild.exe is invoked outside expected developer/build contexts or with anomalous arguments (e.g., non-canonical paths, remote shares, Base64/obfuscated property values). Within a short window, it (a) spawns high-risk LOLBins/script interpreters, (b) writes new PE/DLL/script artifacts into user-writable paths and executes them, (c) loads unsigned/user-writable modules, (d) performs memory injection/thread creation into other processes, and/or (e) initiates outbound network connections.WinEventLog:Microsoft-Windows-CodeIntegrity/Operational
Unsigned/invalid signature modules or images loaded by msbuild.exe or its children→ DC0034 Process MetadataEDR:AMSIMalicious inline C#/script blobs embedded in MSBuild projects if intercepted by AMSI-aware loaders (rare but possible via chained LOLBins)→ DC0029 Script ExecutionTunable:TimeWindowDeveloperHostsSuspiciousChildListRarePathRegexUnsignedOrInvalidSignatureOnlyNetworkReputationThresholdBehaviorRiskScoreThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1127.001
Author: Kiran kumar s, oscd.community
· 2020-10-11 (modified 2022-10-05) · logsource: product=windows category=network_connection · 50e54b8d-ad73-43f8-96a1-5191685b17a4
Detects a possible remote connections to Silenttrinity c2
Rules tagged at the parent level (attack.t1127) 20
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Agro (@agro_sev) oscd.community
· 2020-10-10 (modified 2022-12-09) · logsource: product=windows category=process_creation · 0152550d-3a26-4efd-9f0e-54a0b28ae2f3
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-09 · logsource: product=windows category=process_creation · 18749301-f1c5-4efc-a4c3-276ff1f5b6f8
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-09 (modified 2023-08-03) · logsource: product=windows category=process_creation · 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e
Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
Author: Nik Seetharaman, frack113
· 2019-01-16 (modified 2023-02-03) · logsource: product=windows category=process_creation · 419dbf2b-8a9b-4bea-bf99-7544b050ec8d
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-01 · logsource: product=windows category=process_creation · 49be8799-7b4d-4fda-ad23-cafbefdebbc5
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-02 · logsource: product=windows category=process_creation · 4eddc365-79b4-43ff-a9d7-99422dc34b93
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.
Author: frack113
· 2022-05-02 (modified 2024-04-24) · logsource: product=windows category=process_creation · 52788a70-f1da-40dd-8fbd-73b5865d6568
Detects the execution of the "jsc.exe" (JScript Compiler).
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-09 (modified 2023-02-03) · logsource: product=windows category=process_creation · 6640f31c-01ad-49b5-beb5-83498a5cd8bd
Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2022-05-07 (modified 2022-05-16) · logsource: product=windows category=process_creation · 850d55f9-6eeb-4492-ad69-a72338f65ba4
Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-14 · logsource: product=windows category=process_creation · 9ccba514-7cb6-4c5c-b377-700758f2f120
Detects potentially suspicious child processes of "aspnet_compiler.exe".
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-14 (modified 2025-02-24) · logsource: product=windows category=process_creation · 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
Author: frack113
· 2021-11-24 (modified 2025-02-24) · logsource: product=windows category=process_creation · a01b8329-5953-4f73-ae2d-aa01e1f35f00
Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.
Author: Agro (@agro_sev) oscd.communitly
· 2020-10-13 (modified 2022-02-25) · logsource: product=windows category=process_creation · a746c9b8-a2fb-4ee5-a428-92bee9e99060
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Author: Michael R. (@nahamike01)
· 2020-03-08 (modified 2022-07-14) · logsource: product=windows category=process_creation · a9e416a8-e613-4f8b-88b8-a7d1d1af2f61
Detects the execution of CSharp interactive console by PowerShell
Author: frack113
· 2022-05-16 · logsource: product=windows category=process_creation · b27077d6-23e6-45d2-81a0-e2b356eea5fd
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2019-10-26 (modified 2024-04-22) · logsource: product=windows category=process_creation · b5c7395f-e501-4a08-94d4-57fe7a9da9d2
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Author: frack113
· 2022-05-16 (modified 2022-06-02) · logsource: product=windows category=create_remote_thread · c15e99a3-c474-48ab-b9a7-84549a7a9d16
Detects a remote thread creation of Ttdinject.exe used as proxy
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-11-01 · logsource: product=windows category=process_creation · d047726b-c71c-4048-a99b-2e2f50dc107d
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
Author: Max Altgelt (Nextron Systems)
· 2022-04-06 · logsource: product=windows category=process_creation · df1f26d3-bea7-4700-9ea2-ad3e990cf90e
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Author: Micah Babinski
· 2025-11-25 · logsource: product=windows category=file_event · e890acee-d488-420e-8f20-d9b19b3c3d43
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.