T1127.001 — MSBuild

Tactics: Stealth, Execution · Platforms: Windows

Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and…

Sub-technique of Trusted Developer Utilities Proxy Execution (T1127).

Sigma detection rules (1)

T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild

title: "T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild"
id: dc120361-a7ca-46e1-946a-dec02764925e
description: 'Detects execution of MSBuild.exe, which can compile and run inline C#/VB tasks embedded in an XML project file. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, DeveloperHosts, SuspiciousChildList, RarePathRegex, UnsignedOrInvalidSignatureOnly, NetworkReputationThreshold.'
references:
  - https://attack.mitre.org/techniques/T1127/001
author: Shahrukh Khan
date: 2026-06-10
license: MIT
tags:
  - attack.stealth
  - attack.execution
  - attack.t1127.001

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    Image|endswith: '\MSBuild.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate software builds via Visual Studio, CI/CD pipelines, and developer workstations.

level: medium

Related sub-techniques

Explore