CmdID

CmdID / Techniques

T1127 Trusted Developer Utilities Proxy Execution

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. MITRE ATT&CK

38 programs on CmdID 17 Sigma rules T1127 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1127.001Trusted Developer Utilities Proxy Execution: MSBuild
T1127.002Trusted Developer Utilities Proxy Execution: ClickOnce

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
adplus.exeExecuteappcert.exeExecuteapplauncher.exeExecuteaspnet_compiler.exeAWL Bypasscdb.exeExecutecsc.exeCompilecsi.exeExecutedbgsrv.exeExecutedevtoolslauncher.exeExecutednx.exeExecutedotnet-counters.exeExecutedotnet-trace.exeExecutedxcap.exeExecuteilasm.exeCompileintellitrace.exeExecutejsc.exeCompilemftrace.exeExecutemicrosoft.nodejstools.pressanykey.exeExecutemicrosoft.workflow.compiler.exeExecutempiexec.exeExecutentsd.exeExecutepixtool.exeExecutercsi.exeExecuteremote.exeAWL Bypasssqlps.exeits Sigma ruleste.exeExecutetracker.exeExecutettdinject.exeExecutetttracer.exeExecutevbc.exeCompilevsdiagnostics.exeExecutevsiisexelauncher.exeits Sigma rulesvsjitdebugger.exeExecutevslaunchbrowser.exeExecutevstest.console.exeAWL Bypasswfc.exeAWL Bypasswfmformat.exeExecutewindbg.exeExecute

Sigma rules tagged with it

process creation, the highest levels first
highKavremover Dropped Binary LOLBIN UsageNasreddine Bencherchali (Nextron Systems) · Windows
highPotential Arbitrary Code Execution Via Node.EXENasreddine Bencherchali (Nextron Systems) · Windows
highPotentially Suspicious ASP.NET Compilation Via AspNetCompilerNasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious Child Process of AspNetCompilerNasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious Use of CSharp Interactive ConsoleMichael R. (@nahamike01) · Windows
mediumAspNetCompiler Executionfrack113 · Windows
mediumC# IL Code Compilation Via Ilasm.EXEfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumDetection of PowerShell Execution via Sqlps.exeAgro (@agro_sev) oscd.community · Windows
mediumMicrosoft Workflow Compiler ExecutionNik Seetharaman, frack113 · Windows
mediumNode Process ExecutionsMax Altgelt (Nextron Systems) · Windows
mediumPotential Binary Proxy Execution Via Cdb.EXEBeyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumSQL Client Tools PowerShell Session DetectionAgro (@agro_sev) oscd.communitly · Windows
mediumUse of Remote.exeChristopher Peacock @SecurePeacock, SCYTHE @scythe_io · Windows
mediumUse of TTDInject.exefrack113 · Windows
mediumUse of VSIISExeLauncher.exeNasreddine Bencherchali (Nextron Systems) · Windows
mediumUse of Wfc.exeChristopher Peacock @SecurePeacock, SCYTHE @scythe_io · Windows
lowJScript Compiler Executionfrack113 · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Specify the output filename on the page for csc.exe

csc /out:path/to/file path/to/input_file.csIdentify

Compile into a .dll library instead of an executable on the page for csc.exe

csc /target:library path/to/input_file.csIdentify

An example is here when CmdID’s reading of it names T1127: a Sigma rule it trips is tagged with it, or its abuse is documented as it.