Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)

Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)
MSBuild
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1127/001  external_id: T1127.001     source_name: LOLBAS Msbuild  description: LOLBAS. (n.d.). Msbuild.exe. Retrieved July 31, 2019.  url: https://lolbas-project.github.io/lolbas/Binaries/Msbuild/     source_name: Microsoft MSBuild Inline Tasks 2017  description: Microsoft. (2017, September 21). MSBuild inline tasks. Retrieved March 5, 2021.  url: https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild-inline-tasks?view=vs-2019#code-element     source_name: MSDN MSBuild  description: Microsoft. (n.d.). MSBuild1. Retrieved November 30, 2016.  url: https://msdn.microsoft.com/library/dd393574.aspx     