Important Detection LOLBIN 2026: MSBuild Executing Inline C# Task for Payload Execution

Ibrahim Saud@tektrix

•updated 15 days ago•0•0•1

Detects the execution of MSBuild.exe with command line arguments pointing to project files (.xml or .csproj) that contain C# inline task structures (e.g., CodeTaskFactory, UsingTask). This technique is commonly used to proxy malicious code execution via a trusted Microsoft binary, bypassing certain application control policies.