MSBuild.exe Inline C# Task Execution - AppWhitelist Bypass T1127.001

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

Detects suspicious execution of MSBuild.exe originating from non-standard parent processes or loading project/xml files from unconventional directories such as user-writable or temporary locations. This behavior is indicative of an attempt to bypass application whitelisting and execute arbitrary inline C# code via MSBuild's task functionality.