Trusted Developer Utilities Proxy Execution (T1127) is the abuse of signed build tools, debuggers and deployment frameworks to run attacker code through a process that application control and reputation checks already trust. In ATT&CK v20 it sits under two tactics, Stealth (TA0005) and Execution (TA0002), on Windows, with three sub-techniques: MSBuild (T1127.001), ClickOnce (T1127.002) and JamPlus (T1127.003). The core problem is that developer tools are designed to compile and run code, so any machine that has them and does not need them carries a ready-made execution engine. This page covers the sub-techniques, recorded cases, the v20 detection strategies, the mitigations ATT&CK maps (M1038, M1042, M1021, M1045) with concrete settings, and how to test. Windows system binaries such as rundll32 and mshta are covered in the T1218 System Binary Proxy Execution Defensive Guide; this page stays on developer utilities.
Key takeaways
- Developer tools on non-developer machines are the root cause. Microsoft's App Control recommended block list includes msbuild.exe, the Windows debuggers (cdb.exe, windbg.exe, kd.exe), dotnet.exe, csi.exe, rcsi.exe and fsi.exe unless a scenario explicitly needs them.
- Reputation is not intent. Elastic Security Labs showed in August 2024 that "reputation hijacking" of trusted programs such as JamPlus can bypass Windows Smart App Control without warnings.
- State actors use it in current campaigns. ESET recorded MirrorFace using MSBuild to compile and run its FaceXInjector tool against a Central European diplomatic institute in August 2024.
- ClickOnce trust prompts are a policy setting. The PromptingLevel registry key controls whether ClickOnce apps from the Internet zone can be installed at all.
- Detect by context. ATT&CK v20 detection focuses on a developer utility running outside a developer or build context, then spawning shells, loading unsigned modules, writing executables or connecting out.
What T1127 is and how the sub-techniques differ
ATT&CK describes T1127 as using utilities for software development, debugging and reverse engineering to proxy execution of malicious payloads. These tools are often signed with legitimate certificates, so they run where application control trusts the signer, and the payload runs inside them. ATT&CK also notes that Smart App Control, which checks unsigned applications against a Microsoft cloud service, can be bypassed by abusing signed applications that support running arbitrary code.
| Sub-technique | Mechanism (per ATT&CK v20) | Typical abuse | ATT&CK mitigations |
|---|---|---|---|
| T1127.001 MSBuild | MSBuild.exe processes XML project files; inline tasks (introduced with .NET 4) let C# or Visual Basic code be embedded, compiled and run | Project file with an inline task loads shellcode or a .NET loader | M1038 Execution Prevention, M1042 Disable or Remove Feature or Program |
| T1127.002 ClickOnce | .application and .appref-ms deployments install self-updating .NET apps from a share or web page with minimal interaction and no admin rights | Malicious app disguised as legitimate software; launch through rundll32 with dfshim.dll; startup folder persistence | M1042, M1021 Restrict Web-Based Content, M1045 Code Signing |
| T1127.003 JamPlus | JamPlus build utility runs scripts described in .jam build files | Script run from a reputable build tool to slip past Smart App Control | M1038, M1042 |
The parent technique also covers other developer utilities named by ATT&CK's references, such as the .NET DNX and rcsi.exe hosts, the WinDbg and CDB debuggers, and Tracker.exe from the LOLBAS project.
Real cases
| Actor or software | What was recorded | Defender lesson |
|---|---|---|
| MirrorFace (G1054), Operation AkaiRyū (C0060) | Used MSBuild to compile and run FaceXInjector, a C# injection tool stored in an XML file, which injected the HiddenFace backdoor into a legitimate Windows utility; compiled on each scheduled task run (ESET, March 2025; activity from August 2024) | MSBuild launched by a scheduled task on a non-developer host is a high-confidence alert |
| NOOPLDR (S9025) | Can be executed via MSBuild (ATT&CK, citing JPCERT/CC, July 2024, on MirrorFace) | Loader families reuse the same path across campaigns |
| PlugX (S0013) | A version loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control (Palo Alto Networks, 2017) | Long-running technique, still effective where MSBuild is allowed |
| Frankenstein campaign (C0001) | Threat actors used MSBuild to execute an actor-created file (Cisco Talos, June 2019) | Combined with document lures for initial execution |
| Empire (S0363) | Built-in modules abuse trusted utilities like MSBuild.exe | Open-source frameworks make it routine |
See the MirrorFace Threat Actor Profile Guide and the Mustang Panda Threat Actor Profile Guide for PlugX context.
What to detect and where
ATT&CK v20 gives the parent and each sub-technique its own detection strategy. All of them are Windows behaviour chains.
| Strategy (analytic) | Behaviour to detect | Log sources named in v20 |
|---|---|---|
| DET0172 (AN0488), parent | A signed developer utility runs in a non-developer context and spawns powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe or wscript.exe, loads unsigned or user-writable DLLs, writes then runs a new PE from a user-writable path, or connects out immediately | Security 4688; Sysmon 3, 7, 11, 22; AppLocker audit and block events |
| DET0556 (AN1535), MSBuild | MSBuild.exe outside build contexts or with anomalous arguments (remote shares, non-canonical paths, encoded property values), followed by child LOLBins, new artefacts, unsigned module loads, injection or network connections | Security 4688; Sysmon 3, 7, 8, 10, 11, 22; CodeIntegrity Operational; AMSI where available |
| DET0191 (AN0550), ClickOnce | rundll32.exe invoking dfshim.dll with ShOpenVerbApplication, or dfsvc.exe spawning unexpected children or loading unsigned modules | Security 4688; Sysmon 7; Security-Mitigations telemetry |
| DET0585 (AN1610), JamPlus | JamPlus.exe launching payloads through crafted .jam files, with abnormal process creation or artefacts outside development workflows | Security 4688; Sysmon 3, 11, 22; CodeIntegrity Operational |
Building context
- Define developer and build hosts: keep an inventory (device group or tag) of developer workstations and build agents. MSBuild, debuggers and dotnet on any other host should be rare enough to alert on directly.
- Baseline parents on build hosts: on build agents, MSBuild is normally launched by the CI agent service, Visual Studio or dotnet. MSBuild launched by Office, a browser, explorer.exe with a project file from Downloads, or a scheduled task is suspicious even there.
- Watch project file locations: .csproj, .proj or .xml project files in AppData, Temp, Public or network shares, especially newly written ones, are a lead.
- Network from a compiler: MSBuild restoring packages talks to your package feeds; MSBuild connecting to an unknown host is not package restore.
- ClickOnce sources: dfsvc.exe activity that follows a browser download of an .application file from an Internet site is worth a look in any estate that does not use ClickOnce.
Mitigations with concrete settings
| Mitigation | What to do | Source |
|---|---|---|
| M1038 Execution Prevention | Apply Microsoft's recommended block rules in App Control for Business (WDAC): they deny msbuild.exe, msbuild.dll, Microsoft.Build.dll, the debuggers (cdb, windbg, kd, ntkd, ntsd, dbghost, dbgsvc, dbgsrv), dnx.exe, dotnet.exe, rcsi.exe, csi.exe, fsi.exe, texttransform.exe and others. Microsoft says to allow msbuild.exe only where the reference system is used to build managed applications | Microsoft Learn, Applications that can bypass App Control |
| M1042 Disable or Remove Feature or Program | Do not install Build Tools, SDKs, debuggers or JamPlus on standard user, server or kiosk images; remove them where present | ATT&CK v20 |
| M1021 Restrict Web-Based Content | Set HKLM\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel, value Internet, to Disabled so only apps signed with an explicitly trusted certificate install from the Internet zone (Microsoft's default for applications in that zone is Enabled) | Microsoft Learn, Configure the ClickOnce trust prompt behavior |
| M1045 Code Signing | Require Authenticode-signed ClickOnce deployments from trusted publishers (AuthenticodeRequired or Disabled on other zones as your use allows) | ATT&CK v20; Microsoft Learn |
The App Control block list is written for allow-list policies; deploy it in audit mode first, review CodeIntegrity Operational events for legitimate use, then enforce. See the App Control for Business (WDAC), the M1038 Execution Prevention, the M1042 Disable or Remove Feature or Program, the M1021 Restrict Web-Based Content and the M1045 Code Signing.
Decision guidance: developer machines
Blocking is easy on standard endpoints. Developer workstations and build agents need the tools, so the choice is about containment rather than removal.
- Standard user and server estate: enforce the block list. There is rarely a business reason for MSBuild or a debugger on a finance laptop or a domain controller.
- Developer workstations: allow the tools but monitor parent processes and project file locations, and keep developers on separate device groups with their own policy and alerting thresholds.
- Build agents: allow MSBuild only for the CI agent service account and expected parents, use ephemeral agents where possible, and alert on interactive logons.
- Smart App Control alone is not enough: Elastic's research shows reputation-based checks can be bypassed by trusted programs that run scripts, so pair it with explicit deny rules where you manage policy.
Where identity fits
Developer machines and build agents hold some of the most valuable non-human credentials in an organisation: package feed tokens, signing keys, cloud deployment credentials and CI service account secrets. Code run through MSBuild on a build agent runs with the agent's identity and can read those secrets. Scope CI service accounts to the minimum, keep signing keys in hardware or a managed signing service, and rotate build secrets after any suspicious MSBuild activity on an agent. See the Developer Workstation and IDE Security Guide.
How to test
- Inventory: query EDR or software inventory for msbuild.exe, the debuggers, dotnet.exe and JamPlus on non-developer hosts; that list is your exposure.
- Audit policy: deploy the recommended block rules in audit mode to a pilot ring and review would-be blocks for a few weeks.
- Emulate: with an authorised emulation framework, run a benign MSBuild inline task that starts a harmless child process on a test host outside the developer group.
- Verify detection: confirm DET0556-style alerts fire with parent, project path and child process.
- Enforce and verify block: move the pilot to enforcement and confirm the same test is blocked and logged.
- Rollback plan: keep the previous policy version ready; App Control policies can be replaced through the same management channel if a business tool breaks.
Measures: non-developer hosts with developer utilities installed (target zero), share of estate with the block list enforced, MSBuild executions outside the developer and build groups per month, and time to alert in tests.
Common failure patterns
- Allow by signer: trusting everything signed by Microsoft lets MSBuild and the debuggers through, which is the point of the technique.
- Golden images with SDKs: build tools installed on every image "in case" turn every endpoint into a compiler.
- No developer device group: without one, rules cannot tell normal builds from abuse and get tuned into silence.
- Default ClickOnce prompts: leaving the Internet zone at Enabled lets users install unsigned ClickOnce apps after a single prompt.
- Treating build agents as trusted: agents run untrusted code by design and hold valuable secrets, so they need monitoring and short-lived credentials.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1127, T1127.001, T1127.002, T1127.003; TA0005, TA0002 | Technique, sub-techniques and tactics |
| MITRE ATT&CK v20 | M1038, M1042, M1021, M1045; DET0172, DET0556, DET0191, DET0585 | Mapped mitigations and detection strategies |
| MITRE ATT&CK v20 | T1218, T1218.011, T1204, T1547.001, T1055 | Related techniques named in the sub-technique descriptions and cases |
| MITRE D3FEND | D3-EAL Executable Allowlisting, D3-EDL Executable Denylisting, D3-PLA Process Lineage Analysis, D3-PSA Process Spawn Analysis | Block lists and parent-child analysis |
| NIST SP 800-53 Rev 5 | CM-7(2), CM-7(5), CM-11, SI-4, SI-7(15) | Prevent program execution, allow-by-exception, user-installed software, monitoring, code authentication |
| NIST CSF 2.0 | PR.PS-05, PR.PS-01, DE.CM-09 | Unauthorised software prevention, configuration management, endpoint monitoring |
Practitioner checklist
- Inventory developer utilities on non-developer hosts and remove them.
- Deploy Microsoft's App Control recommended block rules in audit, then enforce.
- Create developer and build agent device groups with their own policy and alert thresholds.
- Alert on MSBuild with unusual parents, project files in user-writable paths or outbound connections.
- Set the ClickOnce Internet zone PromptingLevel to Disabled where ClickOnce from the Internet is not needed.
- Alert on rundll32 with dfshim.dll and on dfsvc.exe spawning unexpected children.
- Collect CodeIntegrity Operational and AppLocker events centrally.
- Scope and rotate build agent credentials and signing keys.
Standards and references
- MITRE ATT&CK: T1127 Trusted Developer Utilities Proxy Execution
- MITRE ATT&CK: T1127.001 MSBuild
- MITRE ATT&CK: T1127.002 ClickOnce
- Microsoft Learn: Applications that can bypass App Control and how to block them
- Microsoft Learn: Configure the ClickOnce trust prompt behavior
- ESET Research: Operation AkaiRyū, MirrorFace invites Europe to Expo 2025
- Elastic Security Labs: Dismantling Smart App Control
- MITRE D3FEND: Executable Denylisting
Related NHI Mgmt Group resources: Living off the Land Guide · ATT&CK Stealth and Defense Impairment Tactics Guide · ATT&CK Execution Tactic Guide · Application Control and Endpoint Prevention Buyer's Guide · Sysmon Guide