TLDR Tech / InfoSec
Text Template
T4 template files (.tt) run C# or VB code at build time through TextTransform.exe, TextTransformCore.exe, t4.exe, and MSBuild.exe. Attackers can plant malicious .tt files on developer machines or in build pipelines to trigger code execution, including supply chain scenarios. This post provides working PoC templates that spawn calc.exe or a MessageBox, and shows how tampering a .csproj with TextTemplatingFileGenerator entries lets MSBuild.exe compile and run arbitrary .tt code via the /t:Transform flag. Detection relies on Sysmon: process creation for the four binaries, image loads of three Microsoft.TextTemplating DLLs (only with MSBuild), and file creation in %Temp% during MSBuild transforms, since t4.exe also spawns dotnet.exe and csc.dll to compile the payload.
Read the full story