Given MSBuild’s ability to process higher level code (e.g. C++ and .NET) on the fly, it has become a popular native Windows tool being leveraged during advanced attacks and pentests. It is sometimes found in malicious activity involving the compiling or running of malware. One common method of compiling and running malicious code using MSBuild is to provide it with a malicious .csproj file, which can be seen in the abused MSBuild’s command line. Examining what processes are launched by a suspicious MSBuild process can help one infer what the suspicious code is doing.