windows enabled community high v1.0.0

msbuild

Used to compile and execute code Located at: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Msbuild.exe; C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe.

📋 Live Preview
msbuild
msbuild

Sandbox: execFile · Timeout: 30s

Capabilities

security.defense-evasion.bypass
security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Build and execute a C# project stored in the target XML file. (Compile and run code)

msbuild.exe {PATH:.xml}

Build and execute a C# project stored in the target csproj file. (Compile and run code)

msbuild.exe {PATH:.csproj}

Executes generated Logger DLL file with TargetLogger export. (Execute DLL)

msbuild.exe /logger:TargetLogger,{PATH_ABSOLUTE:.dll};MyParameters,Foo

Execute JScript/VBScript code through XML/XSL Transformation. Requires Visual Studio MSBuild v14.0+. (Execute project file that contains XslTransformation tag parameters)

msbuild.exe {PATH:.proj}

By putting any valid msbuild.exe command-line options in an RSP file and calling it as above will interpret the options as if they were passed on the command line. (Bypass command-line based detections)

msbuild.exe @{PATH:.rsp}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/file/file_event/file_event_win_shell_write_susp_directory.yml
sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml
splunk https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/suspicious_msbuild_spawn.yml
splunk https://github.com/splunk/security_content/blob/18f63553a9dc1a34122fa123deae2b2f9b9ea391/detections/endpoint/suspicious_msbuild_rename.yml
splunk https://github.com/splunk/security_content/blob/a1afa0fa605639cbef7d528dec46ce7c8112194a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
elastic https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_msbuild_beacon_sequence.toml
elastic https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_msbuild_making_network_connections.toml
elastic https://github.com/elastic/detection-rules/blob/ef7548f04c4341e0d1a172810330d59453f46a21/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml
elastic https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml
elastic https://github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml
blockrule https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
ioc Msbuild.exe should not normally be executed on workstations

Documentation

msbuild

msbuild is a Windows LOLBin. Used to compile and execute code Located at: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Msbuild.exe; C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe.

References