atomic-red-team/atomics/T1127/T1127.yaml

---
attack_technique: T1127
display_name: Trusted Developer Utilities
atomic_tests:
- name: MSBuild Bypass Using Inline Tasks
  description: |
    Executes the code in a project file using. C# Example
  supported_platforms:
    - windows
  input_arguments:
    filename:
      description: Location of the project file
      type: Path
      default: T1127.csproj
  executor:
    name: command_prompt
    elevation_required: false
    command: |
     C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe #{filename}