.. / Msbuild.exe
Star

Used to compile and execute code


Paths:


Resources:
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127/T1127.md
https://github.com/Cn33liz/MSBuildShell
https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/
https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/

Acknowledgement:
Casey Smith - @subtee
Cn33liz - @Cneelis


Detection:
Msbuild.exe should not normally be executed on workstations



AWL bypass

Build and execute a C# project stored in the target XML file.
msbuild.exe pshell.xml
Usecase:Compile and run code
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1127



Execute

Build and execute a C# project stored in the target csproj file.
msbuild.exe project.csproj
Usecase:Compile and run code
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1127