MSBuild.exe
Sources: 300M+ executions observed in the wild.
Summary
Microsoft Build Engine. Compiles and builds .NET applications from project files. Abused as a LOLBin to execute arbitrary C#/VB.NET code via inline tasks in .csproj/.vbproj files without requiring a compiled binary.
MSBuild.exe is the 1536th most commonly executed Windows program in EchoTrail's dataset, observed 652 times across enterprise environments. It typically runs from C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\MSBuild\15.0\Bin and it is most often launched by devenv.exe.
Get this in your tools
The same record for msbuild.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/msbuild.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\MSBuild\15.0\Bin37.88%
- C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin\amd6437.27%
- D:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin8.59%
- C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin3.53%
- C:\Program Files (x86)\MSBuild\14.0\Bin3.37%
- D:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin\amd643.37%
- C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin1.69%
- C:\Program Files (x86)\MSBuild\14.0\Bin\amd641.38%
- C:\Windows\Microsoft.NET\Framework\v4.0.303190.77%
- C:\Windows\Microsoft.NET\Framework64\v4.0.303190.61%
Top Hashes (SHA256)
- e92325c4ae73cefeb2ec0c238bfc781189e9391a7f5f7bb3004b735ce9a763ed38.06%
- 89ae2c5b91237d94efd83a19475593aa1d9d7f7a6c28ecf36580657ac99dd42e31.96%
- 22d0773404852ce0895fc4d582674efc8e4a4f778136626280011ffc52bcc72411.04%
- 53072e81b4b8bc0d76e5ca7ee3941e89e41583b026b78df8af53d3ab5bb46cb28.07%
- 4be96b9592273c3ab2ac051e088a68f13c0e8aa8217dd5e809763abd7db446183.62%
- 62542324c0f5f2f3c796bd28ce963f67691afba5dbe884131414f5873c9d1d383.29%
- 948bb7fc857f910c028d472aba1cdbcc1f8f0f89dc881a5f80b3b5b3785c0c640.82%
- d249b895ae01a6f4639ae78fcd7d87213ff6c25caeb1d70f5c2bb2fb8ebab1e50.66%
- 6817dc933e8f4dc29d1521aab976dbed434d917636848397f4a2c09c610498170.49%
- 01280a8ad0f111956277d0c667c9b4007e4aebc8ff3ed5fba304ac4403814d790.33%
Process Ancestry
Top Grandparents
- explorer.exe32.79%
- Unity.exe22.95%
- devenv.exe13.11%
- cmd.exe8.2%
- dllhost.exe4.92%
- userinit.exe3.28%
Top Parents
- devenv.exe83.9%
- MSBuild.exe6.44%
- cmd.exe1.23%
- python.exe0.77%
- explorer.exe0.31%
Top Children
- VBCSCompiler.exe39.37%
- csc.exe8.4%
- conhost.exe7.58%
- MSBuild.exe6.92%
- cmd.exe1.81%
- java.exe1.65%
Security Analysis
What does MSBuild.exe normally do?
Runs from .NET Framework directory or Visual Studio installation path. Used to build .NET solutions and projects. Creates compiler processes (csc.exe, vbc.exe) as children. CPU-intensive during builds. Common on developer workstations and build servers, rare elsewhere.
When is MSBuild.exe suspicious?
Execution on non-developer machines. Loading a .csproj/.xml file from temp directories, user profile, or network shares. Spawning powershell.exe, cmd.exe, or other LOLBins. Making network connections. Running without a corresponding Visual Studio or CI/CD context. Inline task execution (look for UsingTask in the project file).
How do attackers abuse MSBuild.exe?
msbuild.exe is a powerful LOLBin because it can compile and execute arbitrary C#/VB.NET code at runtime via inline tasks. 1. INLINE TASK EXECUTION: A crafted .csproj file contains a <UsingTask> element with inline C# code. Running "msbuild.exe malicious.csproj" compiles and executes the code in memory. The code can be a reverse shell, downloader, or any .NET payload. 2. APPLICATION WHITELISTING BYPASS: msbuild.exe is a signed Microsoft binary typically allowed by default policies. Attackers drop a .csproj file and execute it via msbuild to bypass AppLocker/WDAC. 3. FILELESS EXECUTION: The malicious code executes in the msbuild.exe process context without creating a separate executable on disk. Used by APT groups, red teams, and commodity malware. Multiple Metasploit modules use msbuild for payload delivery.
Detection guidance
HIGH-CONFIDENCE DETECTIONS: - msbuild.exe loading .csproj/.vbproj files from %TEMP%, %APPDATA%, Downloads, or network shares - msbuild.exe making outbound network connections - msbuild.exe spawning cmd.exe, powershell.exe, or other LOLBins - msbuild.exe run by non-developer users MEDIUM-CONFIDENCE: - Any msbuild.exe execution outside of build/CI environments - msbuild.exe without a corresponding devenv.exe or build tool parent DATA SOURCES: Process creation (Sysmon 1), file creation (Sysmon 11 for .csproj files), network connections (Sysmon 3)
False positive notes
Normal on developer workstations and build servers. CI/CD pipelines (Jenkins, Azure DevOps, TeamCity) run msbuild extensively. NuGet package restores invoke msbuild. Some deployment tools use msbuild to compile configuration transforms.
Related Processes
Ask Rocky about MSBuild.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for MSBuild.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.