Building a bypass with MSBuild
Summary: Cisco Talos analyzed telemetry from Cisco products and collected over 100 potentially malicious MSBuild configuration files, which attackers use to embed malicious source code in project files that executes when a project is built. Talos examined case studies including a VBA macro that created an MSBuild XML file named "expenses.xlsx" alongside a decoy resume document, and an HTA file that fetched an AES256 decryption key from a remote URL to load a Cobalt Strike beacon.
Key Takeaway: Talos found up to 2 percent of endpoints running MSBuild daily, but applying its suspicion criteria - single-argument invocations, unusual parent processes, and the Microsoft.Build.Tasks.v4.0.dll path - narrows that to about one in fifty thousand endpoints, a ratio that determines whether your team can actually investigate the signal.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026