Cross-source coverage
T1127 / ATT&CK
Trusted Developer Utilities Proxy Execution
63 rules · 58 families across 6 sources.
3 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.
Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them. However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging Trusted Developer Utilities Proxy Execution to run their malicious code, adversaries may bypass Smart App Control protections.
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:AppLocker
How MITRE says to detect it DET0172
Behavior-chain, platform-aware detection strategy for T1127 Trusted Developer Utilities Proxy Execution (Windows)
Windows Analytic 0488
A trusted/signed developer utility (parent) is executed in a non-developer context and (a) spawns suspicious children (e.g., powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, wscript.exe), (b) loads unsigned/user-writable DLLs, (c) writes and then runs a new PE from user-writable paths, and/or (d) immediately makes outbound network connections.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=3, 22WinEventLog:AppLockerAppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy
Sub-techniques with coverage
Counted in the 63 above — a rule tagged a sub-technique covers this technique too.
SigmaHQ/sigma
21 rules| Detection | Severity | Format |
|---|---|---|
| Kavremover Dropped Binary LOLBIN Usage | High | Sigma |
| Potential Arbitrary Code Execution Via Node.EXE | High | Sigma |
| Potentially Suspicious ASP.NET Compilation Via AspNetCompiler | High | Sigma |
| Remote Thread Creation Ttdinject.exe Proxy | High | Sigma |
| Silenttrinity Stager Msbuild Activity | High | Sigma |
| Suspicious Child Process of AspNetCompiler | High | Sigma |
| Suspicious File Created by ArcSOC.exe | High | Sigma |
| Suspicious Use of CSharp Interactive Console | High | Sigma |
| AspNetCompiler Execution | Medium | Sigma |
| C# IL Code Compilation Via Ilasm.EXE | Medium | Sigma |
+ 11 more from SigmaHQ/sigma → showing the 10 highest-severity
elastic/detection-rules
16 rules| Detection | Severity | Format |
|---|---|---|
| Microsoft Build Engine Started by an Office Application | High | Elastic TOML |
| Network Activity to a Suspicious Top Level Domain | High | Elastic TOML |
| Potential Credential Access via Trusted Developer Utility | High | Elastic TOML |
| Execution of Persistent Suspicious Program | Medium | Elastic TOML |
| Microsoft Build Engine Started by a Script Process | Medium | Elastic TOML |
| Microsoft Build Engine Started by a System Process | Medium | Elastic TOML |
| MsBuild Making Network Connections | Medium | Elastic TOML |
| Suspicious Execution from a Mounted Device | Medium | Elastic TOML |
| Suspicious .NET Code Compilation | Medium | Elastic TOML |
| Unusual Network Activity from a Windows System Binary | Medium | Elastic TOML |
+ 6 more from elastic/detection-rules → showing the 10 highest-severity
socfortress/Wazuh-Rules
15 rules · 10 families+ 5 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
splunk/security_content
7 rules| Detection | Severity | Format |
|---|---|---|
| ETW Registry Disabled | Undefined | SPL |
| MSBuild Suspicious Spawned By Script Process | Undefined | SPL |
| Suspicious microsoft workflow compiler rename | Undefined | SPL |
| Suspicious microsoft workflow compiler usage | Undefined | SPL |
| Suspicious msbuild path | Undefined | SPL |
| Suspicious MSBuild Rename | Undefined | SPL |
| Suspicious MSBuild Spawn | Undefined | SPL |
Bert-JanP/Hunting-Queries-Detection-Rules
3 rules| Detection | Severity | Format |
|---|---|---|
| MITRE ATT&CK Mapping | Undefined | KQL |
| Suspicious MSBuild Remote Thread | Undefined | KQL |
| TTP Detection Rule: Suspicious network connection from MSBuild | Undefined | KQL |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| MSBuild with Unusual Arguments | Undefined | Elastic TOML |