THREATNOIR
Subscribe
MITRE ATT&CK · T1218

System Binary Proxy Execution

MITRE · cited in 10 of our lessons

Explanation

What attackers do. Attackers run malicious code through signed, trusted system binaries, such as utilities for installing software, running scripts or registering components, so that the activity appears to come from legitimate programs. This serves the Defence Evasion tactic.

How to defend. Use application control rules that restrict rarely needed system utilities, and apply recommended block rules for binaries commonly abused this way. Capture full command lines and parent processes in endpoint logs. Detection rules should focus on unusual arguments, network activity and parent processes for these utilities.

Signs to look for. Look for system utilities loading remote content, running from unusual parents such as Office or browsers, executing script files or DLLs from user folders, and making outbound connections. A common gap is excluding signed Microsoft binaries from monitoring.

Open the technique on MITRE ATT&CK
The official text
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as `split` to proxy execution of malicious commands.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.