Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1127

Trusted Developer Utilities Proxy Execution

Windowsnothing on this site yetT1127 on attack.mitre.org

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Behavior-chain, platform-aware detection strategy for T1127 Trusted Developer Utilities Proxy Execution (Windows)

  • A trusted/signed developer utility (parent) is executed in a non-developer context and (a) spawns suspicious children (e.g., powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, wscript.exe), (b) loads unsigned/user-writable DLLs, (c) writes and then runs a new PE from user-writable paths, and/or (d) immediately makes...

what reduces it

  • M1021 Restrict Web-Based Content. Consider disabling software installation or execution from the internet via developer utilities.
  • M1038 Execution Prevention. Certain developer utilities should be blocked or restricted if not required.
  • M1042 Disable or Remove Feature or Program. Specific developer utilities may not be necessary within a given environment and should be removed if not used.

sub-techniques

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.