Cross-source coverage

T1127.001 / ATT&CK

Trusted Developer Utilities Proxy Execution: MSBuild

22 rules across 5 sources.

From MITRE ATT&CK 19.2

Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.

Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in.NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.

Tactics
Stealth · Execution
Platforms
Windows
Telemetry
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:Microsoft-Windows-CodeIntegrity/OperationalEDR:AMSI

How MITRE says to detect it DET0556

Behavior-chain detection strategy for T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild (Windows)

Windows Analytic 1535

MSBuild.exe is invoked outside expected developer/build contexts or with anomalous arguments (e.g., non-canonical paths, remote shares, Base64/obfuscated property values). Within a short window, it (a) spawns high-risk LOLBins/script interpreters, (b) writes new PE/DLL/script artifacts into user-writable paths and executes them, (c) loads unsigned/user-writable modules, (d) performs memory injection/thread creation into other processes, and/or (e) initiates outbound network connections.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=8
  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Microsoft-Windows-CodeIntegrity/Operational Unsigned/invalid signature modules or images loaded by msbuild.exe or its children
  • EDR:AMSI Malicious inline C#/script blobs embedded in MSBuild projects if intercepted by AMSI-aware loaders (rare but possible via chained LOLBins)

View on attack.mitre.org ↗

elastic/detection-rules

13 rules
Detection Severity Format
Microsoft Build Engine Started by an Office Application High Elastic TOML
Network Activity to a Suspicious Top Level Domain High Elastic TOML
Potential Credential Access via Trusted Developer Utility High Elastic TOML
Execution of Persistent Suspicious Program Medium Elastic TOML
Microsoft Build Engine Started by a Script Process Medium Elastic TOML
Microsoft Build Engine Started by a System Process Medium Elastic TOML
MsBuild Making Network Connections Medium Elastic TOML
Suspicious Execution from a Mounted Device Medium Elastic TOML
Unusual Network Activity from a Windows System Binary Medium Elastic TOML
Delayed Execution via Ping Low Elastic TOML

+ 3 more from elastic/detection-rules → showing the 10 highest-severity

splunk/security_content

4 rules
Detection Severity Format
MSBuild Suspicious Spawned By Script Process Undefined SPL
Suspicious msbuild path Undefined SPL
Suspicious MSBuild Rename Undefined SPL
Suspicious MSBuild Spawn Undefined SPL

Bert-JanP/Hunting-Queries-Detection-Rules

3 rules
Detection Severity Format
MITRE ATT&CK Mapping Undefined KQL
Suspicious MSBuild Remote Thread Undefined KQL
TTP Detection Rule: Suspicious network connection from MSBuild Undefined KQL

SigmaHQ/sigma

1 rule
Detection Severity Format
Silenttrinity Stager Msbuild Activity High Sigma

elastic/protections-artifacts

1 rule
Detection Severity Format
MSBuild with Unusual Arguments Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.