t1127-001-msbuild

name	T1127.001_msbuild
description	Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1127.001","defense-evasion","windows","sub-technique"]
technique_id	T1127.001
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1127/001
tech_stack	["windows"]
cwe_ids	["CWE-693"]
chains_with	["T1127","T1127.002","T1127.003"]
prerequisites	["T1127"]
severity_boost	{"T1127":"Chain with T1127 for deeper attack path","T1127.002":"Chain with T1127.002 for deeper attack path","T1127.003":"Chain with T1127.003 for deeper attack path"}

T1127.001 MSBuild

Sub-technique of: T1127

High-Level Description

Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.

Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Windows

What to Check

• Identify if MSBuild technique is applicable to target environment
• Check Windows systems for indicators of MSBuild
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: MSBuild Bypass Using Inline Tasks (C#)

Executes the code in a project file using msbuild.exe. The default C# project example file (T1127.001.csproj) will simply print "Hello From a Code Fragment" and "Hello From a Class." to the screen.

Supported Platforms: windows

#{msbuildpath}\#{msbuildname} "#{filename}"

Dependencies:

• Project file must exist on disk at specified location (#{filename})

Atomic Test 2: MSBuild Bypass Using Inline Tasks (VB)

Executes the code in a project file using msbuild.exe. The default Visual Basic example file (vb.xml) will simply print "Hello from a Visual Basic inline task!" to the screen.

Supported Platforms: windows

#{msbuildpath}\#{msbuildname} "#{filename}"