gistfile1.txt

MSB-04: Atypical File — .csproj with Inline Task from Legitimate-Looking
Path
Objective:
Determine whether the detection signal can identify a malicious .csproj containing an inline C# task even
when the file resides in a directory that mimics a normal development workspace (complete with a .sln file).
This tests content-based detection rather than path-based heuristics. MSB-01 through MSB-03 already
validate detection from suspicious locations (C:\Temp). This test flips the scenario — the path looks
legitimate, but the content is malicious.
Steps:
1. Create a realistic project directory: mkdir C:\Source\MyProject\src
2. Create a dummy MyProject.sln in C:\Source\MyProject\ (included in test kit)
3. Copy benign_calc.csproj to C:\Source\MyProject\src\MyProject.csproj
4. Execute: MSBuild.exe C:\Source\MyProject\src\MyProject.csproj
5. Confirm calc.exe launches
6. Record command line and file hash
Expected Telemetry:
• MSBuild executing .csproj from a path that looks like a development directory (C:\Source\...)
• A .sln file exists in the parent directory (mimicking a real workspace)
• Project file contains <UsingTask> with CodeTaskFactory — the malicious indicator is in file content, not
the path
• Child process: calc.exe spawned by MSBuild.exe