CmdID

CmdID / Techniques

T1218 System Binary Proxy Execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. MITRE ATT&CK

91 programs on CmdID 123 Sigma rules T1218 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK
T1218.001System Binary Proxy Execution: Compiled HTML File
T1218.002System Binary Proxy Execution: Control Panel
T1218.003System Binary Proxy Execution: CMSTP
T1218.004System Binary Proxy Execution: InstallUtil
T1218.005System Binary Proxy Execution: Mshta
T1218.007System Binary Proxy Execution: Msiexec
T1218.008System Binary Proxy Execution: Odbcconf
T1218.009System Binary Proxy Execution: Regsvcs/Regasm
T1218.010System Binary Proxy Execution: Regsvr32
T1218.011System Binary Proxy Execution: Rundll32
T1218.012System Binary Proxy Execution: Verclsid
T1218.013System Binary Proxy Execution: Mavinject
T1218.014System Binary Proxy Execution: MMC
T1218.015System Binary Proxy Execution: Electron Applications

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
acccheckconsole.exeExecuteaddinutil.exeExecuteagentexecutor.exeExecuteappvlp.exeExecuteatbroker.exeExecutebash.exeExecutebginfo.exeExecutebitsadmin.exeExecutecdb.exeits Sigma rulescertoc.exeExecutecertutil.exeits Sigma ruleschange.exeExecutecmd.exeits Sigma rulescmdl32.exeits Sigma rulescoregen.exeAWL Bypasscsi.exeits Sigma rulescustomshellhost.exeExecutedefaultpack.exeExecutedevicecredentialdeployment.exeits Sigma rulesdevtoolslauncher.exeits Sigma rulesdiskshadow.exeits Sigma rulesdnx.exeits Sigma rulesdotnet-trace.exeits Sigma rulesdotnet.exeAWL Bypassdxcap.exeits Sigma rulesexplorer.exeits Sigma rulesextexport.exeExecutefindstr.exeits Sigma rulesfsutil.exeExecutegpscript.exeExecutehh.exeits Sigma rulesie4uinit.exeExecuteiediagcmd.exeExecuteieexec.exeExecuteimewdbld.exeits Sigma rulesinfdefaultinstall.exeExecuteinstallutil.exeits Sigma rulesldifde.exeits Sigma rulesmofcomp.exeits Sigma rulesmpiexec.exeits Sigma rulesmsconfig.exeExecutemsdeploy.exeExecutemsdt.exeExecutemsedge_proxy.exeits Sigma rulesmsohtmed.exeits Sigma rulesmspub.exeits Sigma rulesofflinescannershell.exeExecutepcwrun.exeExecutepresentationhost.exeExecuteprint.exeits Sigma rulesprotocolhandler.exeits Sigma rulesprovlaunch.exeExecutequery.exeExecuterasautou.exeExecutereg.exeits Sigma rulesregister-cimprovider.exeExecuteregsvr32.exeits Sigma rulesreset.exeExecuterundll32.exeits Sigma rulesrunexehelper.exeExecuterunonce.exeExecuterunscripthelper.exeExecutescp.exeExecutescriptrunner.exeExecutesetres.exeExecutesettingsynchost.exeExecutesetupugc.exeExecutesftp.exeits Sigma rulessigverif.exeExecutesqlps.exeExecutesqltoolsps.exeExecutesquirrel.exeDownloadssh.exeits Sigma rulesstordiag.exeExecutesyncappvpublishingserver.exeExecutete.exeits Sigma rulesunregmp2.exeits Sigma rulesupdate.exeDownloadverclsid.exeits Sigma rulesvisualuiaverifynative.exeAWL Bypassvsdiagnostics.exeits Sigma rulesvsiisexelauncher.exeExecutevsls-agent.exeExecutewab.exeExecutewlrmdr.exeits Sigma ruleswmic.exeExecuteworkfolders.exeExecutewrite.exeExecutewsl.exeExecutewuauclt.exeExecutexwizard.exeExecute

Sigma rules tagged with it

process creation, the highest levels first
highArbitrary File Download Via IMEWDBLD.EXESwachchhanda Shrawan Poudel · Windows
highCurl Download And Execute CombinationSreeman, Nasreddine Bencherchali (Nextron Systems) · Windows
highDevtoolslauncher.exe Executes Specified BinaryBeyu Denis, oscd.community (rule), @_felamos (idea) · Windows
highExecute Pcwrun.EXE To Leverage FollinaNasreddine Bencherchali (Nextron Systems) · Windows
highExecution via stordiag.exeAustin Songer (@austinsonger) · Windows
highExecution via WorkFolders.exeMaxime Thiebaut (@0xThiebaut) · Windows
highFile Download Via Windows Defender MpCmpRun.EXEMatthew Matchen · Windows
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows
highMpiExec LolbinFlorian Roth (Nextron Systems) · Windows
highMSDT Execution Via Answer FileNasreddine Bencherchali (Nextron Systems) · Windows
highOpenWith.exe Executes Specified BinaryBeyu Denis, oscd.community (rule), @harr0ey (idea) · Windows
highPotential Compromised 3CXDesktopApp ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
highPotential Compromised 3CXDesktopApp Update ActivityNasreddine Bencherchali (Nextron Systems) · Windows
highPotential Devil Bait Malware ReconnaissanceNasreddine Bencherchali (Nextron Systems), NCSC (Idea) · Windows
highPotential Exploitation of RCE Vulnerability CVE-2025-33053Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highPotential NTLM Coercion Via Certutil.EXENasreddine Bencherchali (Nextron Systems) · Windows
highPotential Provisioning Registry Key Abuse For Binary Proxy ExecutionNasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel · Windows
highPotential Suspicious Child Process Of 3CXDesktopAppNasreddine Bencherchali (Nextron Systems) · Windows
highPotentially Suspicious Child Processes Spawned by ConHostSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highPotentially Suspicious Mofcomp ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
highProxy Execution Via Wuauclt.EXERoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team · Windows
highRemoteFXvGPUDisablement Abuse Via AtomicTestHarnessesfrack113 · Windows
highRenamed MegaSync ExecutionSittikorn S · Windows
highRenamed ZOHO Dctask64 ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highSdiagnhost Calling Suspicious Child ProcessNextron Systems, @Kostastsale · Windows
highSelf Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious LocationJoseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems) · Windows
highSensitive File Dump Via Print.EXEAyush Anand (Securityinbits) · Windows
highSuspicious AddinUtil.EXE CommandLine ExecutionNasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) · Windows
highSuspicious AgentExecutor PowerShell ExecutionNasreddine Bencherchali (Nextron Systems), memory-shards · Windows
highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious Child Process Of BgInfo.EXENasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious DLL Loaded via CertOC.EXENasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious HH.EXE ExecutionMaxim Pavlunin · Windows
highSuspicious MSDT Parent ProcessNextron Systems · Windows
highSuspicious Provlaunch.EXE Child ProcessNasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious WSL Binary Hijack via Proxy ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious WSL Binary MasqueradingSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious WSL InstallLocation Registry Key Modification Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highUncommon Child Process Of Setres.EXE@gott_cyber, Nasreddine Bencherchali (Nextron Systems) · Windows
highWindows Shell/Scripting Processes Spawning Suspicious ProgramsFlorian Roth (Nextron Systems), Tim Shelton · Windows
highWinrs Local Command ExecutionLiran Ravich, Nasreddine Bencherchali · Windows
mediumAbusing Print ExecutableFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative · Windows
mediumAddinUtil.EXE Execution From Uncommon DirectoryMichael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) · Windows
mediumAgentExecutor PowerShell ExecutionNasreddine Bencherchali (Nextron Systems), memory-shards · Windows
mediumArbitrary Command Execution Using WSLoscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumArbitrary DLL or Csproj Code Execution Via Dotnet.EXEBeyu Denis, oscd.community · Windows
mediumArbitrary File Download Via MSEDGE_PROXY.EXESwachchhanda Shrawan Poudel · Windows
mediumArbitrary File Download Via MSOHTMED.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumArbitrary File Download Via MSPUB.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumArbitrary File Download Via PresentationHost.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumArbitrary File Download Via Squirrel.EXENasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community · Windows
mediumArbitrary MSI Download Via Devinit.EXEFlorian Roth (Nextron Systems) · Windows
mediumBinary Proxy Execution Via Dotnet-Trace.EXEJimmy Bayne (@bohops) · Windows
mediumCOM Object Execution via Xwizard.EXEEnsar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumDeviceCredentialDeployment ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
mediumDiskshadow Child Process SpawnedHarjot Singh @cyb3rjy0t · Windows
mediumDiskshadow Script Mode - Execution From Potential Suspicious LocationNasreddine Bencherchali (Nextron Systems) · Windows
mediumDiskshadow Script Mode - Uncommon Script Extension ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
mediumDiskshadow Script Mode ExecutionIvan Dyachkov, oscd.community · Windows
mediumDLL Execution via Rasautou.exeJulia Fomina, oscd.community · Windows
mediumDLL Loaded via CertOC.EXEAustin Songer @austinsonger · Windows
mediumExecute Files with Msdeploy.exeBeyu Denis, oscd.community · Windows
mediumFile Download Using ProtocolHandler.exefrack113 · Windows
mediumFile Download Via InstallUtil.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumGpscript Executionfrack113 · Windows
mediumHidden Flag Set On File/Directory Via Chflags - MacOSOmar Khaled (@beacon_exe) · macOS
mediumIe4uinit Lolbin Use From Invalid Pathfrack113 · Windows
mediumImport LDAP Data Interchange Format File Via Ldifde.EXE@gott_cyber · Windows
mediumInfDefaultInstall.exe .inf Executionfrack113 · Windows
mediumLolbin Unregmp2.exe Use As Proxyfrack113 · Windows
mediumMalicious PE Execution by Microsoft Visual Studio DebuggerAgro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community · Windows
mediumMicrosoft Workflow Compiler ExecutionNik Seetharaman, frack113 · Windows
mediumNew Capture Session Launched Via DXCap.EXEBeyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumNew Self Extracting Package Created Via IExpress.EXEJoseliyo Sanchez, @Joseliyo_Jstnk · Windows
mediumPotential Application Whitelisting Bypass via Dnx.EXEBeyu Denis, oscd.community · Windows
mediumPotential Arbitrary File Download Via Cmdl32.EXEfrack113 · Windows
mediumPotential Binary Impersonating Sysinternals Toolsfrack113, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumPotential Binary Proxy Execution Via Cdb.EXEBeyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumPotential Binary Proxy Execution Via VSDiagnostics.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumPotential DLL Sideloading Activity Via ExtExport.EXEfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumPotential File Download Via MS-AppInstaller Protocol HandlerNasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel · Windows
mediumPotential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Executionfrack113 · Windows
mediumPotential Password Spraying Attempt Using Dsacls.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumPotential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXEAlejandro Houspanossian ('@lekz86') · Windows
mediumPotential Provlaunch.EXE Binary Proxy Execution AbuseNasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel · Windows
mediumPotential Register_App.Vbs LOLScript AbuseAustin Songer @austinsonger · Windows
mediumPotentially Over Permissive Permissions Granted Using Dsacls.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumPotentially Suspicious Cabinet File ExpansionBhabesh Raj, X__Junior (Nextron Systems) · Windows
mediumPotentially Suspicious Child Process Of DiskShadow.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumPotentially Suspicious Child Process Of VsCodeNasreddine Bencherchali (Nextron Systems) · Windows
mediumPotentially Suspicious CMD Shell Output RedirectNasreddine Bencherchali (Nextron Systems) · Windows
mediumPowerShell MSI Install via WindowsInstaller COM From Remote LocationMeroujan Antonyan (vx3r) · Windows
mediumProcess Memory Dump Via Dotnet-DumpNasreddine Bencherchali (Nextron Systems) · Windows
mediumProcess Proxy Execution Via Squirrel.EXENasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community · Windows
mediumProgram Executed Using Proxy/Local Command Via SSH.EXEfrack113, Nasreddine Bencherchali · Windows
mediumREGISTER_APP.VBS Proxy ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
mediumRegsvr32.EXE Calling of DllRegisterServer Export Function ImplicitlyAndreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems) · Windows
mediumRemote File Download Via Findstr.EXEFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumRundll32.EXE Calling DllRegisterServer Export Function ExplicitlyAndreas Braathen (mnemonic.io) · Windows
mediumScheduled Task Creation with Curl and PowerShell Execution ComboSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumSuspicious Csi.exe UsageKonstantin Grishchenko, oscd.community · Windows
mediumSuspicious Vsls-Agent Command With AgentExtensionPath Loadbohops · Windows
mediumSuspicious ZipExec Executionfrack113 · Windows
mediumSyncAppvPublishingServer Execute Arbitrary PowerShell Codefrack113 · Windows
mediumSyncAppvPublishingServer VBS Execute Arbitrary PowerShell Codefrack113 · Windows
mediumUncommon Assistive Technology Applications Execution Via AtBroker.EXEMateusz Wydra, oscd.community · Windows
mediumUncommon AddinUtil.EXE CommandLine ExecutionMichael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) · Windows
mediumUncommon Child Process Of AddinUtil.EXEMichael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) · Windows
mediumUncommon Child Process Of Appvlp.EXESreeman · Windows
mediumUncommon Link.EXE Parent ProcessNasreddine Bencherchali (Nextron Systems) · Windows
mediumUse of Scriptrunner.exeNasreddine Bencherchali (Nextron Systems) · Windows
mediumUse Of The SFTP.EXE Binary As A LOLBINNasreddine Bencherchali (Nextron Systems) · Windows
mediumUse of VisualUiaVerifyNative.exeChristopher Peacock @SecurePeacock, SCYTHE @scythe_io · Windows
mediumVerclsid.exe Runs COM ObjectVictor Sergeev, oscd.community · Windows
mediumVisual Studio NodejsTools PressAnyKey Renamed ExecutionNasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) · Windows
mediumWlrmdr.EXE Uncommon Argument Or Child Processfrack113, manasmbellani · Windows
mediumWSL Child Process AnomalyNasreddine Bencherchali (Nextron Systems) · Windows
mediumXBAP Execution From Uncommon Locations Via PresentationHost.EXENasreddine Bencherchali (Nextron Systems) · Windows
lowBitLockerTogo.EXE ExecutionJosh Nickels, mttaggart · Windows
lowInsensitive Subfolder Search Via Findstr.EXEFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · Windows
lowMalicious Windows Script Components File Execution by TAEF DetectionAgro (@agro_sev) oscd.community · Windows
lowPotential Proxy Execution Via Explorer.EXE From Shell ProcessFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative · Windows
lowWindows MSIX Package Support Framework AI_STUBS ExecutionMichael Haag, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Display logged in users on the page for query.exe

query userIdentify

Run a Linux command without using a shell on the page for wsl.exe

wsl --exec command command_argumentsIdentify

To disable .ini file mapping in the home directory, type on the page for change user

change user /installIdentify

To enable .ini file mapping in the home directory, type on the page for change user

change user /executeIdentify

To display the current setting for .ini file mapping, type on the page for change user

change user /queryIdentify

Set the hidden flag for a file on the page for chflags

chflags hidden path/to/fileIdentify

Unset the hidden flag for a file on the page for chflags

chflags nohidden path/to/fileIdentify

Build a self-extracting ZIP archive from a given SED file on the page for iexpress

iexpress /n path\to\file.sedIdentify

Run the build process in a minimized window on the page for iexpress

iexpress /n /m path\to\file.sedIdentify

Run the build process in a quiet mode, assuming the user account invoking this command as an administrator or regular user on the page for iexpress

iexpress /n /q:a path\to\file.sedIdentify

To reset the session designated rdp-tcp#6, type on the page for reset session

reset session rdp-tcp#6Identify

To reset the session that uses session ID 3, type on the page for reset session

reset session 3Identify

An example is here when CmdID’s reading of it names T1218: a Sigma rule it trips is tagged with it, or its abuse is documented as it.