AN1535 Analytic 1535

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>MSBuild.exe is invoked outside expected developer/build contexts or with anomalous arguments (e.g., non-canonical paths, remote shares, Base64/obfuscated property values). Within a short window, it (a) spawns high-risk LOLBins/script interpreters, (b) writes new PE/DLL/script artifacts into user-writable paths and executes them, (c) loads unsigned/user-writable modules, (d) performs memory injection/thread creation into other processes, and/or (e) initiates outbound network connections.</p>

Detects: T1127.001 MSBuild
Part of: DET0556 Behavior-chain detection strategy for T1127.001 Trusted Developer Utilities Proxy Execution: MSBuild (Windows)

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Security	`EventCode=4688`	DC0032 Process Creation
WinEventLog:Sysmon	`EventCode=7`	DC0016 Module Load
WinEventLog:Sysmon	`EventCode=11`	DC0039 File Creation
WinEventLog:Sysmon	`EventCode=3, 22`	DC0082 Network Connection Creation
WinEventLog:Sysmon	`EventCode=8`	DC0020 Process Modification
WinEventLog:Sysmon	`EventCode=10`	DC0035 Process Access
WinEventLog:Microsoft-Windows-CodeIntegrity/Operational	`Unsigned/invalid signature modules or images loaded by msbuild.exe or its children`	DC0034 Process Metadata
EDR:AMSI	`Malicious inline C#/script blobs embedded in MSBuild projects if intercepted by AMSI-aware loaders (rare but possible via chained LOLBins)`	DC0029 Script Execution

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`TimeWindow`	Correlation window between msbuild.exe start, payload write, suspicious child spawn, and network (e.g., 0–30 minutes).
`DeveloperHosts`	Tag/allowlist known developer or CI/CD hosts to reduce noise.
`SuspiciousChildList`	High-risk children (powershell.exe, rundll32.exe, regsvr32.exe, cmd.exe, wscript.exe, mshta.exe) spawned by msbuild.exe.
`RarePathRegex`	Regex of user-writable or atypical paths (e.g., %TEMP%, %APPDATA%, OneDrive sync dirs) used to drop payloads.
`UnsignedOrInvalidSignatureOnly`	Tighten alerting to cases with invalid or missing signatures on modules/children.
`NetworkReputationThreshold`	Minimum rarity/risk score for external destinations to alert.
`BehaviorRiskScoreThreshold`	Numeric threshold for fused, scored correlation (e.g., ≥70/100 triggers an alert).