AhnLab Details MSBuild Abuse for Fileless Execution and DLL Sideloading
Summary
AhnLab explains how attackers abuse signed MSBuild.exe to run inline C# code, download payloads and enable DLL sideloading. It describes a reported phishing campaign and recommends behavior- and context-based detection.
Key points
- MSBuild.exe can execute inline C# from .csproj files, enabling code execution without a separate malicious binary.
- A January 2025 proof of concept used MSBuild to run shellcode and establish a TCP reverse shell; AhnLab reported no Windows 11 Defender alert or block during its test.
- A February 2026 campaign reported by Lab52 used a phishing attachment containing a signed executable renamed to resemble a document and a project file that MSBuild loaded automatically.
- The campaign's project file downloaded additional files to temporary paths with randomized filenames; a downloaded malicious DLL was then loaded by a signed executable.
- AhnLab recommends monitoring MSBuild execution context, project-file execution, suspicious subprocesses, multiple downloads, randomized filenames, and DLL loading behavior.
Article Details
- Attack Vectors
- A phishing email delivers a compressed attachment containing a signed executable renamed to resemble a document and a .csproj file.
- Running the executable triggers MSBuild to automatically load the adjacent .csproj file, which runs inline C# to download additional files.
- A downloaded executable loads a malicious DLL from the same directory, enabling DLL sideloading.
- A proof-of-concept uses MSBuild to compile and execute C# that loads shellcode and establishes a TCP reverse shell.
- Defensive Notes
- Monitor MSBuild running outside development contexts, especially when launched from Outlook, a browser, or a download path, and investigate suspicious subprocesses.
- Monitor .csproj and .xml execution, particularly after archive extraction or from %TEMP%.
- Inspect MSBuild network activity for external connections, multiple downloads in a short period, and files with randomized names.
- Detect cases where a legitimate signed executable loads a malicious DLL, and analyze process relationships, execution context, file creation, and DLL load flows.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | onedown[.]gesecole[.]net | Payload-hosting domain used by the campaign's download endpoints. |
| MD5 | 769687f93869a70511aac1ef7c752455 | Reported file hash associated with the MSBuild attack campaign. |
| MD5 | 7a75e713db41c28378e823322fdea0fd | Reported file hash associated with the MSBuild attack campaign. |
| URL | hxxps[:]//onedown[.]gesecole[.]net/download/a3693kfa836 | Campaign download URL used by the inline C# script to retrieve files. |
| URL | hxxps[:]//onedown[.]gesecole[.]net/download/a3696kfa836 | Campaign download URL used by the inline C# script to retrieve files. |
| URL | hxxps[:]//onedown[.]gesecole[.]net/download/a3699kfa836 | Campaign download URL used by the inline C# script to retrieve files. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign script contains Base64-encoded download URLs.T1036 · MasqueradingThe campaign executable is renamed to resemble a document file to reduce user suspicion.T1071.001 · Web ProtocolsThe inline script retrieves campaign files from external HTTPS endpoints using TLS.T1105 · Ingress Tool TransferThe inline C# script downloads additional files from an external server to the victim system.T1127.001 · MSBuildMSBuild.exe executes attacker-controlled .csproj files containing inline C#.T1204.002 · Malicious FileThe attack proceeds when the user clicks the executable in the attachment.T1566.001 · Spearphishing AttachmentThe campaign begins with a phishing email carrying a compressed attachment containing the executable and project file.T1574.002 · DLL Side-LoadingA downloaded malicious DLL is loaded by a legitimate signed executable from the same directory.
People
Vendors
Products
Windows 11A January 2025 proof-of-concept showed MSBuild compiling and running main.cs to load shellcode and establish a TCP reverse shell that bypassed Windows 11 Defender alerts.Windows DefenderIt reviews proof-of-concept and real-world campaigns demonstrating Windows Defender bypasses via automatic project-file execution and recommends behavior-based, multi-layered detection focused on process behavior,