Command Line
msbuild.exe project.csproj
Description
Build and execute a C# project stored in project.csproj.
Risk
Low
Risk Reason
This is a common activity for developers and not immediately suspicious.
Fidelity
Medium
Fidelity Reason
This type of activity is typically uncommon for most users and would really only occur for developers.
Operating Systems
Killchain Phases
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1127/001
Description: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)
Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)
Tactics: