Msbuild.exe · LOLBAS

01 / TRADECRAFT

Command reference

5 examples

AWL Bypass1

Build and execute a C# project stored in the target XML file.

COMMAND

msbuild.exe {PATH:.xml}

USE CASE: Compile and run code
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Execute · CSharp

Execute4

EXAMPLE 01T1127.001

Build and execute a C# project stored in the target csproj file.

COMMAND

msbuild.exe {PATH:.csproj}

USE CASE: Compile and run code
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Execute · CSharp

EXAMPLE 02T1127.001

Executes generated Logger DLL file with TargetLogger export.

COMMAND

msbuild.exe /logger:TargetLogger,{PATH_ABSOLUTE:.dll};MyParameters,Foo

USE CASE: Execute DLL
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Execute · DLL

EXAMPLE 03T1127.001

Execute JScript/VBScript code through XML/XSL Transformation. Requires Visual Studio MSBuild v14.0+.

COMMAND

msbuild.exe {PATH:.proj}

USE CASE: Execute project file that contains XslTransformation tag parameters
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Execute · XSL

EXAMPLE 04T1036

By putting any valid msbuild.exe command-line options in an RSP file and calling it as above will interpret the options as if they were passed on the command line.

COMMAND

msbuild.exe @{PATH:.rsp}

USE CASE: Bypass command-line based detections
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Execute · CMD

02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Msbuild.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Msbuild.exe

C:\Windows\Microsoft.NET\Framework\v3.5\Msbuild.exe

C:\Windows\Microsoft.NET\Framework64\v3.5\Msbuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Msbuild.exe

C:\Program Files (x86)\MSBuild\14.0\bin\MSBuild.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

12 resources

Indicators & detection notes

IOC
Msbuild.exe should not normally be executed on workstations

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee

Cn33liz@Cneelis

Jimmy@bohops