CyberStack

MITRE ATT&CK / Techniques / T1127.001

Trusted Developer Utilities Proxy Execution: MSBuild

ID
T1127.001
Tactics
TA0002 Execution, TA0005 Stealth
Sub-technique of
T1127 Trusted Developer Utilities Proxy Execution
Platforms
Windows
Data sources
Process Creation, Module Load, File Creation, Network Connection Creation, Process Modification, Process Access, Process Metadata, Script Execution
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.[2]

Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.[2][3] MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.[4]

Detection

Mitigations (2)

M1038 Execution Prevention

Use application control configured to block execution of msbuild.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the msbuild.exe application and to prevent abuse.[1]

M1042 Disable or Remove Feature or Program

MSBuild.exe may not be necessary within an environment and should be removed if not being used.

Software (3)

References

  1. Microsoft WDAC
  2. MSDN MSBuild
  3. Microsoft MSBuild Inline Tasks 2017
  4. LOLBAS Msbuild