T1127.001 MSBuild
sub-techniqueEnterpriseAdversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations. Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in.NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file. MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (8)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
Model
Isolate
Deceive
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.PSPlatform Securitystrong · backed by 3 of 5 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 2 of 5 mapped controls
- ID.IMImprovementmoderate · backed by 2 of 5 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (5)
Security controls that mitigate this.
software (3)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
Detected by (Sigma) (1)
Sigma detection rules related to this.
source
Where this definition is published.