MSBuild Inline Task Payload for Proxy Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the presence of an MSBuild inline task payload within HTTP traffic. It specifically looks for the combination of the strings "<UsingTask", "TaskFactory", and "Code" (case-insensitive) within the file data of an HTTP response. This pattern is indicative of an MSBuild inline task, which can be used by attackers for proxy execution, often as a defense evasion technique.