# T1127.001 MSBuild > As of 2026-11-12, T1127.001 (MSBuild) appears in 10 tracked threats, first reported 2026-02-27 and most recently 2026-11-06, with linked actors including APT43, Kapibala, Kimsuky; it most often appears alongside T1204.002 (Malicious File). - **Tracked threats:** 10 (3 critical, 7 high) - **First seen:** 2026-02-27 - **Last seen:** 2026-11-06 - **Threat actors:** 5 - **Detection rules:** 27 (counts only; unlock with TL Creds) ## Key facts - **ID:** T1127.001 - **Framework:** MITRE ATT&CK - **Tactics:** Execution, Stealth (formerly Defense Evasion) - **Matrix:** Enterprise - **Parent:** T1127 - **Data as of:** 2026-11-12 - **MITRE:** https://attack.mitre.org/techniques/T1127/001/ ## Activity timeline T1127.001 first appeared in tracked threats on 2026-02-27 and was most recently reported on 2026-11-06. The busiest month was 2026-10 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11. ## How adversaries use it T1127.001 MSBuild is catalogued by MITRE ATT&CK under the Execution and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of [T1127 Trusted Developer Utilities Proxy Execution](https://intel.threadlinqs.com/technique/T1127). Threadlinqs maps 10 of 3847 tracked threats (0.3%) to it; by severity that is 3 critical, 7 high. Threats that use T1127.001 most often also use [T1204.002 Malicious File](https://intel.threadlinqs.com/technique/T1204.002) (9 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (8 threats), [T1059.001 PowerShell](https://intel.threadlinqs.com/technique/T1059.001) (8 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (8 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 5 tracked threat actors appear in the threats that use T1127.001; the most frequent are [APT43](https://intel.threadlinqs.com/actor/APT43) (1), [Kapibala](https://intel.threadlinqs.com/actor/Kapibala) (1), [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky) (1), [Mustang Panda](https://intel.threadlinqs.com/actor/Mustang%20Panda) (1), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (1). ## Mitigations MITRE ATT&CK lists 2 mitigations for T1127.001. - [M1038 Execution Prevention](https://attack.mitre.org/mitigations/M1038/) - [M1042 Disable or Remove Feature or Program](https://attack.mitre.org/mitigations/M1042/) ## Data sources Telemetry that can reveal T1127.001, per MITRE ATT&CK. - Command — Command Execution - Process — Process Creation ## Threat actors using it - [APT43](https://intel.threadlinqs.com/actor/APT43) — 1 - [Kapibala](https://intel.threadlinqs.com/actor/Kapibala) — 1 - [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky) — 1 - [Mustang Panda](https://intel.threadlinqs.com/actor/Mustang%20Panda) — 1 - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 1 ## Tracked threats 10 tracked threats use T1127.001. - [Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron…](https://intel.threadlinqs.com/threat/TL-2026-5440) — high — 2026-11-06 - [XWorm .NET Loader (RSG_UnityApp) Reused Across Judicial-Themed Phishing Campaigns Targeting Colombia and the…](https://intel.threadlinqs.com/threat/TL-2026-4643) — high — 2026-10-28 - [Kimsuky-Linked Funhouse Ransomware (Endpoint Ransomware Variant) Distributed via Malicious Hangul Resume…](https://intel.threadlinqs.com/threat/TL-2026-3335) — high — 2026-10-12 - [Iranian State-Aligned Hackers Use Fake Dubai Airports Coding Test (Blinder Tunnel / CL-STA-1178) to Target…](https://intel.threadlinqs.com/threat/TL-2026-2986) — high — 2026-10-06 - [Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti…](https://intel.threadlinqs.com/threat/TL-2026-2619) — critical — 2026-09-22 - [ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealer](https://intel.threadlinqs.com/threat/TL-2026-2142) — high — 2026-08-25 - [JavaScript-Driven PureLogs Infostealer Variant Delivered via Purchase-Order Phishing with Process Hollowing…](https://intel.threadlinqs.com/threat/TL-2026-0591) — high — 2026-05-26 - [Telnyx Python SDK PyPI Compromise — TeamPCP CanisterWorm Supply Chain Attack (telnyx 4.87.1/4.87.2)](https://intel.threadlinqs.com/threat/TL-2026-0361) — critical — 2026-04-14 - [CPUID Supply Chain Compromise — Trojanized CPU-Z 2.19, HWMonitor 1.63, PerfMonitor 2, and powerMAX…](https://intel.threadlinqs.com/threat/TL-2026-0347) — critical — 2026-04-10 - [PlugX Meeting Invitation Campaign — China-Nexus MSBuild LOLBIN + GDATA DLL Sideloading, RC4 Encrypted C2…](https://intel.threadlinqs.com/threat/TL-2026-0153) — high — 2026-02-27 ## Related CVEs CVEs referenced by the tracked threats that use T1127.001, most frequent first. - [CVE-2022-0847](https://intel.threadlinqs.com/cve/CVE-2022-0847) - [CVE-2023-36025](https://intel.threadlinqs.com/cve/CVE-2023-36025) - [CVE-2023-54391](https://intel.threadlinqs.com/cve/CVE-2023-54391) - [CVE-2026-34908](https://intel.threadlinqs.com/cve/CVE-2026-34908) - [CVE-2026-34909](https://intel.threadlinqs.com/cve/CVE-2026-34909) - [CVE-2026-34910](https://intel.threadlinqs.com/cve/CVE-2026-34910) - [CVE-2026-54569](https://intel.threadlinqs.com/cve/CVE-2026-54569) - [CVE-2026-56271](https://intel.threadlinqs.com/cve/CVE-2026-56271) - [CVE-2026-60004](https://intel.threadlinqs.com/cve/CVE-2026-60004) - [CVE-2026-60137](https://intel.threadlinqs.com/cve/CVE-2026-60137) - [CVE-2026-63030](https://intel.threadlinqs.com/cve/CVE-2026-63030) - [CVE-2026-7273](https://intel.threadlinqs.com/cve/CVE-2026-7273) - [CVE-2026-79756](https://intel.threadlinqs.com/cve/CVE-2026-79756) ## Detection coverage Threadlinqs maintains 27 detection rules mapped to T1127.001 (SPL 12, KQL 7, Sigma 8). Rule content unlocks with TL Creds on a free account; this page shows counts only. 27 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds ## Parent technique [T1127 Trusted Developer Utilities Proxy Execution](https://intel.threadlinqs.com/technique/T1127) — 19 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1127.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp