Applied Cybernetics Group
T1218 System Binary Proxy Execution
- Technique
T1218- Tactics
- Defense Evasion
- Research, 90 days
- 1
- KEV CVEs mapped
- 2
- SigmaHQ rules
- 153
- Elastic, Splunk
- 113
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1218
MITRE description
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-11-03Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure
Detection coverage
SigmaHQ community rules
- Potential Devil Bait Malware Reconnaissance (emerging-threats)
- Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE (emerging-threats)
- Potential Compromised 3CXDesktopApp Execution (emerging-threats)
- Potential Suspicious Child Process Of 3CXDesktopApp (emerging-threats)
- Potential Compromised 3CXDesktopApp Update Activity (emerging-threats)
- Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load (emerging-threats)
- Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access (emerging-threats)
- Potential Exploitation of RCE Vulnerability CVE-2025-33053 (emerging-threats)
- Dllhost.EXE Initiated Network Connection To Non-Local IP Address (threat-hunting)
- Diskshadow Child Process Spawned (threat-hunting)
- Diskshadow Script Mode Execution (threat-hunting)
- Potential Proxy Execution Via Explorer.EXE From Shell Process (threat-hunting)
- Potential DLL Sideloading Activity Via ExtExport.EXE (threat-hunting)
- New Self Extracting Package Created Via IExpress.EXE (threat-hunting)
- Microsoft Workflow Compiler Execution (threat-hunting)
- Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly (threat-hunting)
- Rundll32.EXE Calling DllRegisterServer Export Function Explicitly (threat-hunting)
- Arbitrary Command Execution Using WSL (threat-hunting)
- Hidden Flag Set On File/Directory Via Chflags - MacOS (core)
- MSI Installation From Web (core)
- Suspicious DotNET CLR Usage Log Artifact (core)
- Self Extraction Directive File Created In Potentially Suspicious Location (core)
- Created Files by Microsoft Sync Center (core)
- Legitimate Application Dropped Archive (core)
- Legitimate Application Dropped Executable (core)
Showing 25 of 153 community rules.
the full set is tagged attack.t1218 in
SigmaHQ.
Elastic and Splunk rules
- Execution via OpenClaw Agent (elastic)
- Execution via GitHub Actions Runner (elastic)
- Unusual Process Spawned by a Host (elastic)
- Unusual Process Spawned by a Parent Process (elastic)
- Unusual Process Spawned by a User (elastic)
- Host Detected with Suspicious Windows Process(es) (elastic)
- Parent Process Detected with Suspicious Windows Process(es) (elastic)
- User Detected with Suspicious Windows Process(es) (elastic)
- Shell Execution via Elastic Endpoint (elastic)
- Proxy Shell Execution via Busybox (elastic)
- Curl or Wget Egress Network Connection via LoLBin (elastic)
- Dynamic Linker (ld.so) Creation (elastic)
- Shared Object Load via LoLBin (elastic)
- Potential Proxy Execution via Systemd-run (elastic)
- Potentially Suspicious Process Started via tmux or screen (elastic)
- Suspicious Command Execution via Busybox Proxy (elastic)
- Potential Privilege Escalation via SUID/SGID Proxy Execution (elastic)
- Potential File Transfer via Certreq (elastic)
- Network Activity to a Suspicious Top Level Domain (elastic)
- Potential Command and Control via Internet Explorer (elastic)
- RMM Software Installation from a Commonly Abused Web Service (elastic)
- RMM Software Installation from an Internet-Originated MSI (elastic)
- Suspicious ScreenConnect Client Child Process (elastic)
- Potential Protocol Tunneling via Yuze (elastic)
- Suspicious Shell Execution via Velociraptor (elastic)
Showing 25 of 113.