Skip to content

T1218 System Binary Proxy Execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.2 Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.31

Item Value
ID T1218
Sub-techniques T1218.001, T1218.002, T1218.003, T1218.004, T1218.005, T1218.007, T1218.008, T1218.009, T1218.010, T1218.011, T1218.012, T1218.013, T1218.014
Tactics TA0005
Platforms Linux, Windows, macOS
Version 3.0
Created 18 April 2018
Last Modified 18 April 2022

Procedure Examples

ID Name Description
G0032 Lazarus Group Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.45

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program Many native binaries may not be necessary within a given environment.
M1038 Execution Prevention Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network.
M1050 Exploit Protection Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using using trusted binaries to bypass application control.
M1026 Privileged Account Management Restrict execution of particularly vulnerable binaries to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Creation
DS0011 Module Module Load
DS0029 Network Traffic Network Connection Creation
DS0009 Process OS API Execution
DS0024 Windows Registry Windows Registry Key Modification

References

  1. GTFOBins. (2020, November 13). split. Retrieved April 18, 2022. ↩

  2. Oddvar Moe et al. (2022, February). Living Off The Land Binaries, Scripts and Libraries. Retrieved March 7, 2022. ↩

  3. Torbjorn Granlund, Richard M. Stallman. (2020, March null). split(1) — Linux manual page. Retrieved March 25, 2022. ↩

  4. Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022. ↩

  5. Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022. ↩