System Binary Proxy Execution (T1218)

Tactic: Stealth · Platforms: Linux, macOS, Windows

The interactive view maps 1 detection strategy, 6 mitigations, 2 threat groups to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.

Sub-techniques

• Compiled HTML File (T1218.001)
• Control Panel (T1218.002)
• CMSTP (T1218.003)
• InstallUtil (T1218.004)
• Mshta (T1218.005)
• Msiexec (T1218.007)
• Odbcconf (T1218.008)
• Regsvcs/Regasm (T1218.009)
• Regsvr32 (T1218.010)
• Rundll32 (T1218.011)
• Verclsid (T1218.012)
• Mavinject (T1218.013)
• MMC (T1218.014)
• Electron Applications (T1218.015)

Explore

• Open T1218 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1218
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan