TA0005 · DEFENSE EVASION
MSBuild
Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio.
Detect it with
Use process monitoring to monitor the execution and arguments of MSBuild.exe. Compare recent invocations of those binaries with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity.
Why it matters on shift
MSBuild is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context