.. /Msbuild.exe
Star

AWL bypass
Execute (DLL, WSH)

Used to compile and execute code


Paths:

Resources:
Acknowledgements:

Detection:

AWL bypass

  1. Build and execute a C# project stored in the target XML file.

    msbuild.exe pshell.xml
    Use case
    Compile and run code
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1127.001

Execute

  1. Build and execute a C# project stored in the target csproj file.

    msbuild.exe project.csproj
    Use case
    Compile and run code
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1127.001

  2. Executes generated Logger DLL file with TargetLogger export

    msbuild.exe /logger:TargetLogger,C:\Loggers\TargetLogger.dll;MyParameters,Foo
    Use case
    Execute DLL
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1127.001
    Tags
    Execute: DLL
    This LOLBAS executes Dynamic-Link Libraries (DLLs).

  3. Execute jscript/vbscript code through XML/XSL Transformation. Requires Visual Studio MSBuild v14.0+.

    msbuild.exe project.proj
    Use case
    Execute project file that contains XslTransformation tag parameters
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1127.001
    Tags
    Execute: WSH
    This LOLBAS executes scripts in Windows Script Host (WSH) languages, such as VBScript and JScript.

  4. By putting any valid msbuild.exe command-line options in an RSP file and calling it as above will interpret the options as if they were passed on the command line.

    msbuild.exe @sample.rsp
    Use case
    Bypass command-line based detections
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1036