T1216 System Script Proxy Execution

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. MITRE ATT&CK

8 programs on CmdID 11 Sigma rules T1216 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1216.001System Script Proxy Execution: PubPrn

T1216.002System Script Proxy Execution: SyncAppvPublishingServer

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highPotential Manage-bde.wsf Abuse To Proxy Executionoscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious CustomShellHost ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

mediumAssembly Loading Via CL_LoadAssembly.ps1frack113, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumExecute Code with Pester.batJulia Fomina, oscd.community · Windows

mediumPotential Process Execution Proxy Via CL_Invocation.ps1Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova · Windows

mediumPotential Script Proxy Execution Via CL_Mutexverifiers.ps1Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova, frack113 · Windows

mediumRemote Code Execute via Winrm.vbsJulia Fomina, oscd.community · Windows

mediumUncommon Sigverif.EXE Child ProcessNasreddine Bencherchali (Nextron Systems) · Windows