Cross-source coverage
T1216 / ATT&CK
System Script Proxy Execution
From MITRE ATT&CK 19.2
Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.
- Tactics
- Stealth
- Platforms
- Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:PowerShell
How MITRE says to detect it DET0466
Detection of Script-Based Proxy Execution via Signed Microsoft Utilities
Windows Analytic 1288
Execution of Microsoft-signed scripts (e.g., pubprn.vbs, installutil.exe, wscript.exe, cscript.exe) used to proxy execution of untrusted or external binaries. Behavior is detected through command-line process lineage, child process spawning, and unsigned payload execution from signed parent.
WinEventLog:SysmonEventCode=1WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=10WinEventLog:SysmonEventCode=11
Sub-techniques with coverage
Counted in the 25 above — a rule tagged a sub-technique covers this technique too.
SigmaHQ/sigma
15 rules| Detection | Severity | Format |
|---|---|---|
| Potential Manage-bde.wsf Abuse To Proxy Execution | High | Sigma |
| Suspicious CustomShellHost Execution | High | Sigma |
| Assembly Loading Via CL_LoadAssembly.ps1 | Medium | Sigma |
| AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl | Medium | Sigma |
| AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File | Medium | Sigma |
| Execute Code with Pester.bat | Medium | Sigma |
| Execute Code with Pester.bat as Parent | Medium | Sigma |
| Launch-VsDevShell.PS1 Proxy Execution | Medium | Sigma |
| Potential Process Execution Proxy Via CL_Invocation.ps1 | Medium | Sigma |
| Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 | Medium | Sigma |
+ 5 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
5 rules · 3 familieselastic/protections-artifacts
3 rules| Detection | Severity | Format |
|---|---|---|
| Inhibit System Recovery via Signed Binary Proxy | Undefined | Elastic TOML |
| Scriptlet Proxy Execution via PubPrn | Undefined | Elastic TOML |
| Suspicious Windows Schedule Child Process | Undefined | Elastic TOML |
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Delayed Execution via Ping | Low | Elastic TOML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Windows System Script Proxy Execution Syncappvpublishingserver | Undefined | SPL |