MSBuild.exe
Summary
Microsoft Build Engine. Compiles and builds .NET applications from project files. Abused as a LOLBin to execute arbitrary C#/VB.NET code via inline tasks in .csproj/.vbproj files without requiring a compiled binary.
MSBuild.exe is the 1536th most commonly executed Windows program in EchoTrail's dataset, observed 652 times across enterprise environments. It typically runs from C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\MSBuild\15.0\Bin and it is most often launched by devenv.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\MSBuild\15.0\Bin37.88%
- C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin\amd6437.27%
- D:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin8.59%
- C:\Program Files\Microsoft Visual Studio\2022\Enterprise\MSBuild\Current\Bin3.53%
- C:\Program Files (x86)\MSBuild\14.0\Bin3.37%
- D:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin\amd643.37%
- C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin1.69%
- C:\Program Files (x86)\MSBuild\14.0\Bin\amd641.38%
- C:\Windows\Microsoft.NET\Framework\v4.0.303190.77%
- C:\Windows\Microsoft.NET\Framework64\v4.0.303190.61%
Top Hashes (SHA256)
- e92325c4ae73cefeb2ec0c238bfc781189e9391a7f5f7bb3004b735ce9a763ed38.06%
- 89ae2c5b91237d94efd83a19475593aa1d9d7f7a6c28ecf36580657ac99dd42e31.96%
- 22d0773404852ce0895fc4d582674efc8e4a4f778136626280011ffc52bcc72411.04%
- 53072e81b4b8bc0d76e5ca7ee3941e89e41583b026b78df8af53d3ab5bb46cb28.07%
- 4be96b9592273c3ab2ac051e088a68f13c0e8aa8217dd5e809763abd7db446183.62%
- 62542324c0f5f2f3c796bd28ce963f67691afba5dbe884131414f5873c9d1d383.29%
- 948bb7fc857f910c028d472aba1cdbcc1f8f0f89dc881a5f80b3b5b3785c0c640.82%
- d249b895ae01a6f4639ae78fcd7d87213ff6c25caeb1d70f5c2bb2fb8ebab1e50.66%
- 6817dc933e8f4dc29d1521aab976dbed434d917636848397f4a2c09c610498170.49%
- 01280a8ad0f111956277d0c667c9b4007e4aebc8ff3ed5fba304ac4403814d790.33%
Process Ancestry
Top Grandparents
- explorer.exe32.79%
- Unity.exe22.95%
- devenv.exe13.11%
- cmd.exe8.2%
- dllhost.exe4.92%
- userinit.exe3.28%
Top Parents
- devenv.exe83.9%
- MSBuild.exe6.44%
- cmd.exe1.23%
- python.exe0.77%
- explorer.exe0.31%
Top Children
- VBCSCompiler.exe39.37%
- csc.exe8.4%
- conhost.exe7.58%
- MSBuild.exe6.92%
- cmd.exe1.81%
- java.exe1.65%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does MSBuild.exe normally do?
Runs from .NET Framework directory or Visual Studio installation path. Used to build .NET solutions and projects. Creates compiler processes (csc.exe, vbc.exe) as children. CPU-intensive during builds. Common on developer workstations and build servers, rare elsewhere.
When is MSBuild.exe suspicious?
Execution on non-developer machines. Loading a .csproj/.xml file from temp directories, user profile, or network shares. Spawning powershell.exe, cmd.exe, or other LOLBins. Making network connections. Running without a corresponding Visual Studio or CI/CD context. Inline task execution (look for UsingTask in the project file).
How do attackers abuse MSBuild.exe?
msbuild.exe is a powerful LOLBin because it can compile and execute arbitrary C#/VB.NET code at runtime via inline tasks. 1. INLINE TASK EXECUTION: A crafted .csproj file contains a <UsingTask> element with inline C# code. Running "msbuild.exe malicious.csproj" compiles and executes the code in memory. The code can be a reverse shell, downloader, or any .NET payload. 2. APPLICATION WHITELISTING BYPASS: msbuild.exe is a signed Microsoft binary typically allowed by default policies. Attackers drop a .csproj file and execute it via msbuild to bypass AppLocker/WDAC. 3. FILELESS EXECUTION: The malicious code executes in the msbuild.exe process context without creating a separate executable on disk. Used by APT groups, red teams, and commodity malware. Multiple Metasploit modules use msbuild for payload delivery.
Detection guidance
HIGH-CONFIDENCE DETECTIONS: - msbuild.exe loading .csproj/.vbproj files from %TEMP%, %APPDATA%, Downloads, or network shares - msbuild.exe making outbound network connections - msbuild.exe spawning cmd.exe, powershell.exe, or other LOLBins - msbuild.exe run by non-developer users MEDIUM-CONFIDENCE: - Any msbuild.exe execution outside of build/CI environments - msbuild.exe without a corresponding devenv.exe or build tool parent DATA SOURCES: Process creation (Sysmon 1), file creation (Sysmon 11 for .csproj files), network connections (Sysmon 3)
False positive notes
Normal on developer workstations and build servers. CI/CD pipelines (Jenkins, Azure DevOps, TeamCity) run msbuild extensively. NuGet package restores invoke msbuild. Some deployment tools use msbuild to compile configuration transforms.
Related Processes
Ask Rocky about MSBuild.exe
Rocky answers questions about MSBuild.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.