MITRE ATT&CKtechnique
T1216 System Script Proxy Execution
- Domain
- enterprise
- Tactics
- Stealth
- Platforms
- Windows
- Version
- 3.0
- Created
- 2018-04-18
Description
Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.
Related
Tactic · MITRE ATT&CK (1)
- TA0005 Stealth tactic
Referenced by MITRE ATT&CK · mitigates (1)
- M1038 Execution Prevention mitigation
Referenced by MITRE ATT&CK · subtechnique of (2)
Referenced by Compliance · mitigates (7)
- CIS-2.7 Allowlist Authorized Scripts CIS Safeguard v8.1
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-CM-7 Least Functionality NIST 800-53 control
- NIST-SI-10 Information Input Validation NIST 800-53 control
- NIST-SI-4 System Monitoring NIST 800-53 control
- NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
References
- https://github.com/api0cradle/UltimateAppLockerByPassList GitHub Ultimate AppLocker Bypass List
- https://github.com/LOLBAS-Project/LOLBAS#criteria LOLBAS Project