[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1218":3},{"item":4,"lessons":18,"controls":60,"related":90},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1218","T1218","System Binary Proxy Execution",10,"MITRE","**What attackers do.** Attackers run malicious code through signed, trusted system binaries, such as utilities for installing software, running scripts or registering components, so that the activity appears to come from legitimate programs. This serves the Defence Evasion tactic.\n\n**How to defend.** Use application control rules that restrict rarely needed system utilities, and apply recommended block rules for binaries commonly abused this way. Capture full command lines and parent processes in endpoint logs. Detection rules should focus on unusual arguments, network activity and parent processes for these utilities.\n\n**Signs to look for.** Look for system utilities loading remote content, running from unusual parents such as Office or browsers, executing script files or DLLs from user folders, and making outbound connections. A common gap is excluding signed Microsoft binaries from monitoring.","Adversaries may bypass process and\u002For signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.\n\nSimilarly, on Linux systems adversaries may abuse trusted binaries such as `split` to proxy execution of malicious commands.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1218\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56],{"slug":21,"title":22,"published_at":23},"global-group-abuses-legitimate-winmerge-tool-to-deploy-ransomware-via-phishing","Global Group Abuses Legitimate WinMerge Tool to Deploy Ransomware via Phishing","2026-09-30T16:20:57.597+00:00",{"slug":25,"title":26,"published_at":27},"cisa-guidance-deploy-cyber-decoys-to-detect-and-disrupt-adversaries","CISA Guidance: Deploy Cyber Decoys to Detect and Disrupt Adversaries","2026-09-16T18:22:19.71+00:00",{"slug":29,"title":30,"published_at":31},"nodejs-abused-as-trojan-horse-for-malware-delivery","Node.js Abused as Trojan Horse for Malware Delivery","2026-09-03T12:21:12.111+00:00",{"slug":33,"title":34,"published_at":35},"fake-captcha-lures-users-into-running-malicious-commands","Fake CAPTCHA Lures Users Into Running Malicious Commands","2026-08-30T10:20:21.007+00:00",{"slug":37,"title":38,"published_at":39},"quicagent-backdoor-exploits-living-off-the-land-techniques-in-myanmar-espionage-campaign","QUICAgent Backdoor Exploits Living-off-the-Land Techniques in Myanmar Espionage Campaign","2026-08-24T14:21:51.882+00:00",{"slug":41,"title":42,"published_at":43},"malvertising-campaign-assembles-malware-in-the-browser-to-evade-detection","Malvertising Campaign Assembles Malware in the Browser to Evade Detection","2026-07-25T22:20:20.422+00:00",{"slug":45,"title":46,"published_at":47},"ai-coding-agents-blur-the-line-between-legitimate-tools-and-attacker-behavior","AI Coding Agents Blur the Line Between Legitimate Tools and Attacker Behavior","2026-07-08T18:20:45.269+00:00",{"slug":49,"title":50,"published_at":51},"undetected-threats-linger-for-years-due-to-monitoring-and-response-gaps","Undetected Threats Linger for Years Due to Monitoring and Response Gaps","2026-07-02T10:20:39.933+00:00",{"slug":53,"title":54,"published_at":55},"dragonforce-abuses-microsoft-teams-relay-servers-to-hide-ransomware-c2-traffic","DragonForce Abuses Microsoft Teams Relay Servers to Hide Ransomware C2 Traffic","2026-06-17T12:20:58.586+00:00",{"slug":57,"title":58,"published_at":59},"clickfix-campaign-exploits-user-trust-and-windows-tools-for-stealth-attacks","ClickFix Campaign Exploits User Trust and Windows Tools for Stealth Attacks","2026-04-25T05:10:01.079+00:00",[61,66,71,76,81,86],{"slug":62,"name":63,"problem":64,"stories":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",9,{"slug":67,"name":68,"problem":69,"stories":70},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",4,{"slug":72,"name":73,"problem":74,"stories":75},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",3,{"slug":77,"name":78,"problem":79,"stories":80},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",2,{"slug":82,"name":83,"problem":84,"stories":85},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":87,"name":88,"problem":89,"stories":85},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[91,97,101,106,110,114,118,122],{"family":92,"item":93,"code":94,"title":95,"together":96},"cis","13","Control 13","Network Monitoring and Defense",6,{"family":92,"item":98,"code":99,"title":100,"together":96},"2","Control 2","Inventory and Control of Software Assets",{"family":102,"item":103,"code":104,"title":105,"together":96},"nist-800-53","cm-7","CM-7","Least Functionality",{"family":102,"item":107,"code":108,"title":109,"together":96},"si-3","SI-3","Malicious Code Protection",{"family":92,"item":111,"code":112,"title":113,"together":70},"9","Control 9","Email and Web Browser Protections",{"family":92,"item":115,"code":116,"title":117,"together":70},"10","Control 10","Malware Defenses",{"family":119,"item":120,"code":121,"title":121,"together":75},"itil","overview","ITIL",{"family":92,"item":123,"code":124,"title":125,"together":75},"8","Control 8","Audit Log Management"]