T1218
System Binary Proxy Execution
Linux · macOS · Windows2 pieces on this siteT1218 on attack.mitre.org
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Q3 detection rule pack: persistence and execution
Sigma, YARA and network rules built from the quarter's CISA advisories, with the advisory cited on every rule and the indicator table they came from attached as CSV.
Read
Analyses, case studies, guides, references and interview questions.
False-Positive Hall of Fame No. 1: six alerts that were the software working
Chrome opens a pipe that Cobalt Strike also opens. Chrome's updater reads LSASS. Discord ships a signed binary that launches other binaries. Six alerts that fire on normal software, each with the benign explanation and the discriminator, and a count of how often the public rulebase admits any of this.
how MITRE says to see it
Detection of Proxy Execution via Trusted Signed Binaries Across Platforms
- Execution of trusted, Microsoft-signed binaries such as `rundll32.exe`, `msiexec.exe`, or `regsvr32.exe` used to execute externally hosted, unsigned, or suspicious payloads through command-line parameters or network retrieval.
- Execution of trusted system binaries (e.g., `split`, `tee`, `bash`, `env`) used in uncommon sequences or chained behaviors to execute malicious payloads or perform actions inconsistent with normal system or script behavior.
- Use of system binaries such as `osascript`, `bash`, or `curl` to download or execute unsigned code or files in conjunction with application proxying.
what reduces it
- M1037 Filter Network Traffic. Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.
- M1021 Restrict Web-Based Content. Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.
- M1038 Execution Prevention. Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network.
- M1026 Privileged Account Management. Restrict execution of particularly vulnerable binaries to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage.
- M1050 Exploit Protection. Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using using trusted binaries to bypass application control.
- M1042 Disable or Remove Feature or Program. Many native binaries may not be necessary within a given environment.