Activity timeline
T1127.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.
How adversaries use it
T1127.001 MSBuild is catalogued by MITRE ATT&CK under the Execution and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of T1127 Trusted Developer Utilities Proxy Execution. Threadlinqs maps 10 of 3847 tracked threats (0.3%) to it; by severity that is 3 critical, 7 high.
Threats that use T1127.001 most often also use T1204.002 Malicious File (9 threats), T1027 Obfuscated Files or Information (8 threats), T1059.001 PowerShell (8 threats), T1071.001 Web Protocols (8 threats), T1082 System Information Discovery (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
5 tracked threat actors appear in the threats that use T1127.001; the most frequent are APT43 (1), Kapibala (1), Kimsuky (1), Mustang Panda (1), TeamPCP (1).
Mitigations
MITRE ATT&CK lists 2 mitigations for T1127.001.
Data sources
Telemetry that can reveal T1127.001, per MITRE ATT&CK.
- Command — Command Execution
- Process — Process Creation
Threat actors using it
Tracked threats
10 tracked threats use T1127.001.
- Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron…high
- XWorm .NET Loader (RSG_UnityApp) Reused Across Judicial-Themed Phishing Campaigns Targeting Colombia and the…high
- Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware Variant) Distributed via Malicious Hangul Resume…high
- Iranian State-Aligned Hackers Use Fake Dubai Airports Coding Test (Blinder Tunnel / CL-STA-1178) to Target…high
- Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti…critical
- ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealerhigh
- JavaScript-Driven PureLogs Infostealer Variant Delivered via Purchase-Order Phishing with Process Hollowing…high
- Telnyx Python SDK PyPI Compromise — TeamPCP CanisterWorm Supply Chain Attack (telnyx 4.87.1/4.87.2)critical
- CPUID Supply Chain Compromise — Trojanized CPU-Z 2.19, HWMonitor 1.63, PerfMonitor 2, and powerMAX…critical
- PlugX Meeting Invitation Campaign — China-Nexus MSBuild LOLBIN + GDATA DLL Sideloading, RC4 Encrypted C2…high
Detection coverage
Threadlinqs maintains 27 detection rules mapped to T1127.001 (SPL 12, KQL 7, Sigma 8). Rule content unlocks with TL Creds on a free account; this page shows counts only.
Parent technique
T1127 Trusted Developer Utilities Proxy Execution — 19 tracked threats at the technique level.