Trusted Developer Utilities Proxy Execution T1127
Tactics: Stealth, Execution
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.
Events covered
10 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Sysmon | Event ID 7 | Image loaded |
| Sysmon | Event ID 8 | CreateRemoteThread |
| Sysmon | Event ID 11 | FileCreate |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Defender-DeviceProcessEvents | any | Process activity |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Authoring guide
These 59 rules share fields, values, and exclusions.
Fields filtered most (33 distinct)
These fields appear most often in rule filters.
Top indicator values (278 distinct)
These values appear most often in rule predicates.
Exclusions (122 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 21 rules
- AspNetCompiler Execution
- C# IL Code Compilation Via Ilasm.EXE
- Detection of PowerShell Execution via Sqlps.exe
- JScript Compiler Execution
- Kavremover Dropped Binary LOLBIN Usage
- Microsoft Workflow Compiler Execution
- Node Process Executions
- Potential Arbitrary Code Execution Via Node.EXE
- Potential Binary Proxy Execution Via Cdb.EXE
- Potential Mftrace.EXE Abuse
- Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
- Remote Thread Creation Ttdinject.exe Proxy
- Silenttrinity Stager Msbuild Activity
- SQL Client Tools PowerShell Session Detection
- Suspicious Child Process of AspNetCompiler
- Suspicious File Created by ArcSOC.exe
- Suspicious Use of CSharp Interactive Console
- Use of Remote.exe
- Use of TTDInject.exe
- Use of VSIISExeLauncher.exe
- Use of Wfc.exe
Elastic 19 rules
- Anomalous Linux Compiler Activity
- Delayed Execution via Ping
- Execution of Persistent Suspicious Program
- Execution via Microsoft DotNet ClickOnce Host
- Execution via MS VisualStudio Pre/Post Build Events
- Microsoft Build Engine Started an Unusual Process
- Microsoft Build Engine Started by a Script Process
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Build Engine Using an Alternate Name
- MsBuild Making Network Connections
- MSBuild with Unusual Arguments
- Network Activity to a Suspicious Top Level Domain
- Potential Credential Access via Trusted Developer Utility
- Process Injection by the Microsoft Build Engine
- Suspicious .NET Code Compilation
- Suspicious Execution from a Mounted Device
- Unusual Network Activity from a Windows System Binary
- Unusual Process Network Connection
Splunk 16 rules
- CDB Execution (Sysmon)
- CDB Execution (Windows Event Log)
- ETW Registry Disabled
- Microsoft Build Engine Suspicious Parent Process (Sysmon)
- Microsoft Build Engine Suspicious Parent Process (Windows Event Log)
- MSBuild Suspicious Spawned By Script Process
- Proxy Execution via Appcert (PowerShell)
- Proxy Execution via Appcert (Sysmon)
- Proxy Execution via Appcert (Windows Event Log)
- Suspicious microsoft workflow compiler rename
- Suspicious microsoft workflow compiler usage
- Suspicious msbuild path
- Suspicious MSBuild Rename
- Suspicious MSBuild Spawn
- Unusual AppCert Child Process (Sysmon)
- Unusual AppCert Child Process (Windows Event Log)