Detecting MSBuild and InstallUtil Abuse

MSBuild and InstallUtil ship with the .NET Framework and are signed by Microsoft. MSBuild can execute C# defined inline in a project file; InstallUtil runs code in an assembly’s uninstall routine. Both execute code without launching a conventional new binary, and both are absent from most application allowlists. On hosts where nobody builds software, any use is suspicious.

Signals at a Glance

MSBuild Inline Tasks

A malicious project file defines a CodeTaskFactory or RoslynCodeTaskFactory task with the payload embedded as C# source. MSBuild compiles it on the fly, which is why you see csc.exe or a Roslyn compiler spawned beneath it. Developers do this in build servers and IDEs; almost nobody does it from a user's Downloads folder.

// Microsoft Defender XDR (KQL) - MSBuild outside expected developer context
let devParents = dynamic(["devenv.exe", "msbuild.exe", "vsbuild.exe", "dotnet.exe",
                          "jenkins.exe", "agent.worker.exe", "teamcity-agent.exe"]);
DeviceProcessEvents
| where FileName =~ "msbuild.exe" or InternalFileName =~ "MSBuild.exe"
| where not(InitiatingProcessFileName in~ (devParents))
| where ProcessCommandLine matches regex @"(?i)\.(xml|csproj|proj|targets|tmp)\b"
   or FolderPath !startswith @"C:\Program Files"
   or InitiatingProcessFileName in~ ("winword.exe","excel.exe","outlook.exe","wscript.exe","cscript.exe","cmd.exe","powershell.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
          ProcessCommandLine, FolderPath
// tune/validate: scope to non-developer device groups first to cut noise.

InstallUtil and the Compiler Chain

InstallUtil is rarer still. Legitimate use is installing a .NET service with a log file on a build or admin host. Malware uses the uninstall switch with logging suppressed to run its payload quietly:

title: InstallUtil Executing Assembly from Writable Path
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\InstallUtil.exe'
  switches:
    CommandLine|contains|all:
      - '/U'
      - '/LogToConsole=false'
  writable:
    CommandLine|contains:
      - '\Users\'
      - '\Temp\'
      - '\ProgramData\'
      - '\AppData\'
  condition: selection and (switches or writable)
level: high
# tune/validate: allow your known service-installation pipeline.

• Alert on csc.exe or vbc.exe parented by MSBuild or InstallUtil outside build servers; it signals compilation of an inline task.
• Add Sysmon Event 3: MSBuild making outbound connections is unusual outside package restore on build hosts.
• Block the binaries on non-developer endpoints with application control or ASR rules, then alert on the attempts.
• Review the project file; inline tasks include readable C# that identifies the payload and its staging infrastructure.