MITRE ATT&CKsub-technique

T1127.001 MSBuild

Published 2020-03-27 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth, Execution
Platforms
Windows
Version
2.0
Created
2020-03-27

Description

Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations. Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1127 Trusted Developer Utilities Proxy Execution technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1038 Execution Prevention mitigation
  • M1042 Disable or Remove Feature or Program mitigation

Referenced by MITRE ATT&CK · uses (5)

  • C0060 Operation AkaiRyū campaign
  • S9025 NOOPLDR software (malware)
  • C0001 Frankenstein campaign
  • S0363 Empire software (tool)
  • S0013 PlugX software (malware)

Referenced by Compliance · mitigates (7)

  • CIS-2.3 Address Unauthorized Software CIS Safeguard v8.1
  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References