Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1216

System Script Proxy Execution

Windowsnothing on this site yetT1216 on attack.mitre.org

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of Script-Based Proxy Execution via Signed Microsoft Utilities

  • Execution of Microsoft-signed scripts (e.g., pubprn.vbs, installutil.exe, wscript.exe, cscript.exe) used to proxy execution of untrusted or external binaries. Behavior is detected through command-line process lineage, child process spawning, and unsigned payload execution from signed parent.

what reduces it

  • M1038 Execution Prevention. Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.

sub-techniques

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.