One Day Sec

How can MSBuild be used for persistence in Visual Studio projects?

Attackers can achieve persistence by modifying a Visual Studio `.csproj` file to include an Inline Task that runs arbitrary code (e.g., shellcode) every time the project is built. This technique, described in the article Use MSBuild To Do More, leverages the fact that Visual Studio automatically invokes MSBuild during compilation, so malicious code executes without additional triggers. It builds on the concept of Visual Studio build events and can be combined with Use AppDomainManager to maintain persistence for stealthier execution.
VisualStudio persistence.csprojbuild eventMSBuildAppLocker bypass

Browse all Q&A →