{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1127","id":"T1127","name":"Trusted Developer Utilities Proxy Execution","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1127","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"3d7691d89785048a7213ce36524b4d59bacb5c17a9124650dc9ea6f9e74a70ea","description":"Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.\n\nSmart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them.(Citation: Microsoft Smart App Control) However, adversaries may leverage \"reputation hijacking\" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127) to run their malicious code, adversaries may bypass Smart App Control protections.(Citation: Elastic Security Labs)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1127","external_id":"T1127"},{"source_name":"Exploit Monday WinDbg","description":"Graeber, M. (2016, August 15). Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20160816135945/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"},{"source_name":"Elastic Security Labs","description":"Joe Desimone. (2024, August 5). Dismantling Smart App Control. Retrieved March 21, 2025.","url":"https://www.elastic.co/security-labs/dismantling-smart-app-control"},{"source_name":"LOLBAS Tracker","description":"LOLBAS. (n.d.). Tracker.exe. Retrieved July 31, 2019.","url":"https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/"},{"source_name":"Microsoft Smart App Control","description":"Microsoft. (n.d.). Smart App Control Frequently Asked Questions. Retrieved April 4, 2025.","url":"https://support.microsoft.com/en-us/windows/smart-app-control-frequently-asked-questions-285ea03d-fa88-4d56-882e-6698afdb7003"},{"source_name":"engima0x3 RCSI Bypass","description":"Nelson, M. (2016, November 21). Bypassing Application Whitelisting By Using rcsi.exe. Retrieved May 26, 2017.","url":"https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/"},{"source_name":"engima0x3 DNX Bypass","description":"Nelson, M. (2017, November 17). Bypassing Application Whitelisting By Using dnx.exe. Retrieved May 25, 2017.","url":"https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1127.001","id":"T1127.001","name":"MSBuild","page":"techniques/enterprise/T1127.001/"},{"key":"enterprise/T1127.002","id":"T1127.002","name":"ClickOnce","page":"techniques/enterprise/T1127.002/"},{"key":"enterprise/T1127.003","id":"T1127.003","name":"JamPlus","page":"techniques/enterprise/T1127.003/"}],"telemetry":[{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0034","name":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component","category":"Host state and inventory","description":"Point-in-time process properties such as owner, executable and start time.","collection_focus":"Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["process_id","image","owner_uid","started_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1127","id":"T1127","name":"Trusted Developer Utilities Proxy Execution","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1127","technique_page":"techniques/enterprise/T1127/","page":"detections/enterprise/T1127/","status":"rule_source_available","counts":{"sigma":19,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"c15e99a3-c474-48ab-b9a7-84549a7a9d16","title":"Remote Thread Creation Ttdinject.exe Proxy","status":"test","level":"high","logsource":{"product":"windows","category":"create_remote_thread"},"data_path":"data/detection-rules/c15e99a3-c474-48ab-b9a7-84549a7a9d16.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml","author":"frack113","kind":"sigma"},{"id":"e890acee-d488-420e-8f20-d9b19b3c3d43","title":"Suspicious File Created by ArcSOC.exe","status":"experimental","level":"high","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/e890acee-d488-420e-8f20-d9b19b3c3d43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml","author":"Micah Babinski","kind":"sigma"},{"id":"a01b8329-5953-4f73-ae2d-aa01e1f35f00","title":"AspNetCompiler Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a01b8329-5953-4f73-ae2d-aa01e1f35f00.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml","author":"frack113","kind":"sigma"},{"id":"9ccba514-7cb6-4c5c-b377-700758f2f120","title":"Suspicious Child Process of AspNetCompiler","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9ccba514-7cb6-4c5c-b377-700758f2f120.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_child_process.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9f50fe98-fe5c-4a2d-86c7-fad7f63ed622","title":"Potentially Suspicious ASP.NET Compilation Via AspNetCompiler","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9f50fe98-fe5c-4a2d-86c7-fad7f63ed622.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"b5c7395f-e501-4a08-94d4-57fe7a9da9d2","title":"Potential Binary Proxy Execution Via Cdb.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b5c7395f-e501-4a08-94d4-57fe7a9da9d2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml","author":"Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"a9e416a8-e613-4f8b-88b8-a7d1d1af2f61","title":"Suspicious Use of CSharp Interactive Console","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a9e416a8-e613-4f8b-88b8-a7d1d1af2f61.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml","author":"Michael R. (@nahamike01)","kind":"sigma"},{"id":"850d55f9-6eeb-4492-ad69-a72338f65ba4","title":"C# IL Code Compilation Via Ilasm.EXE","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/850d55f9-6eeb-4492-ad69-a72338f65ba4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ilasm_il_code_compilation.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"52788a70-f1da-40dd-8fbd-73b5865d6568","title":"JScript Compiler Execution","status":"test","level":"low","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/52788a70-f1da-40dd-8fbd-73b5865d6568.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_jsc_execution.yml","author":"frack113","kind":"sigma"},{"id":"d047726b-c71c-4048-a99b-2e2f50dc107d","title":"Kavremover Dropped Binary LOLBIN Usage","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/d047726b-c71c-4048-a99b-2e2f50dc107d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_kavremover_uncommon_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"4eddc365-79b4-43ff-a9d7-99422dc34b93","title":"Use of Remote.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4eddc365-79b4-43ff-a9d7-99422dc34b93.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_remote.yml","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","kind":"sigma"},{"id":"b27077d6-23e6-45d2-81a0-e2b356eea5fd","title":"Use of TTDInject.exe","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/b27077d6-23e6-45d2-81a0-e2b356eea5fd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml","author":"frack113","kind":"sigma"},{"id":"18749301-f1c5-4efc-a4c3-276ff1f5b6f8","title":"Use of VSIISExeLauncher.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/18749301-f1c5-4efc-a4c3-276ff1f5b6f8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"49be8799-7b4d-4fda-ad23-cafbefdebbc5","title":"Use of Wfc.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/49be8799-7b4d-4fda-ad23-cafbefdebbc5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_wfc.yml","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","kind":"sigma"},{"id":"3d48c9d3-1aa6-418d-98d3-8fd3c01a564e","title":"Potential Mftrace.EXE Abuse","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/3d48c9d3-1aa6-418d-98d3-8fd3c01a564e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mftrace_child_process.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"0152550d-3a26-4efd-9f0e-54a0b28ae2f3","title":"Detection of PowerShell Execution via Sqlps.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0152550d-3a26-4efd-9f0e-54a0b28ae2f3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml","author":"Agro (@agro_sev) oscd.community","kind":"sigma"},{"id":"a746c9b8-a2fb-4ee5-a428-92bee9e99060","title":"SQL Client Tools PowerShell Session Detection","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a746c9b8-a2fb-4ee5-a428-92bee9e99060.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml","author":"Agro (@agro_sev) oscd.communitly","kind":"sigma"},{"id":"6640f31c-01ad-49b5-beb5-83498a5cd8bd","title":"Potential Arbitrary Code Execution Via Node.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6640f31c-01ad-49b5-beb5-83498a5cd8bd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_node_abuse.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"df1f26d3-bea7-4700-9ea2-ad3e990cf90e","title":"Node Process Executions","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/df1f26d3-bea7-4700-9ea2-ad3e990cf90e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_node_adobe_creative_cloud_abuse.yml","author":"Max Altgelt (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0172","name":"Behavior-chain, platform-aware detection strategy for T1127 Trusted Developer Utilities Proxy Execution (Windows)","url":"https://attack.mitre.org/detectionstrategies/DET0172","stix_id":"x-mitre-detection-strategy--f47cb8dc-2120-4541-9306-95053218ba8a","relationship_id":"relationship--e9ff67a4-4136-46d0-b91e-d354c84215a1","description":"","analytics":[{"id":"AN0488","name":"Analytic 0488","guidance":"A trusted/signed developer utility (parent) is executed in a non-developer context and (a) spawns suspicious children (e.g., powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, wscript.exe), (b) loads unsigned/user-writable DLLs, (c) writes and then runs a new PE from user-writable paths, and/or (d) immediately makes outbound network connections.","url":"https://attack.mitre.org/detectionstrategies/DET0172#AN0488","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlation window between developer utility execution, payload write, and network egress (e.g., 0–30 minutes)."},{"field":"AllowedUtilitiesList","description":"Org-specific list of dev utilities legitimately used on build/dev hosts to suppress noise."},{"field":"DeveloperHosts","description":"List of known developer/build systems where these tools are expected; raise severity off-host."},{"field":"SuspiciousChildList","description":"Child processes considered high-risk when spawned by dev utilities (powershell.exe, rundll32.exe, regsvr32.exe, cmd.exe, wscript.exe, mshta.exe)."},{"field":"RarePathRegex","description":"Regex of user-writable or atypical paths (e.g., %TEMP%, %APPDATA%, recycle bin, public profile) for payload drops."},{"field":"UnsignedOrInvalidSignatureOnly","description":"Toggle to alert only when child/payload is unsigned or signature invalid to reduce noise."},{"field":"ParentProcessAllowList","description":"Known orchestrators (e.g., CI/CD agents) that often run these utilities legitimately."},{"field":"NetworkReputationThreshold","description":"Heuristic for rare/unknown destination (no DNS reputation, new domain, geo outside region)."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0488","source_url":"https://attack.mitre.org/detectionstrategies/DET0172#AN0488","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0488","source_url":"https://attack.mitre.org/detectionstrategies/DET0172#AN0488","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0488","source_url":"https://attack.mitre.org/detectionstrategies/DET0172#AN0488","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0488","source_url":"https://attack.mitre.org/detectionstrategies/DET0172#AN0488","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0034","component":"Process Metadata","name":"WinEventLog:AppLocker","channel":"AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy","platforms":["Windows"],"analytic_id":"AN0488","source_url":"https://attack.mitre.org/detectionstrategies/DET0172#AN0488","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"}]}]}],"telemetry_references":[{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0034","name":"Process Metadata","tag":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1021","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M1021","kind":"course-of-action","description":"Consider disabling software installation or execution from the internet via developer utilities.","relationship_id":"relationship--b2d73149-8bc7-45c4-baa3-66f5aa55b49d","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Certain developer utilities should be blocked or restricted if not required.","relationship_id":"relationship--8c0286e0-036d-4282-9e54-6938c958b7e9","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Specific developer utilities may not be necessary within a given environment and should be removed if not used.","relationship_id":"relationship--f4e83a18-a2bf-45af-aa6b-18f72646d8b6","references":[]}],"candidates":[{"id":"1ec1c269-d6bd-49e7-b71b-a461f7fa7bc8","name":"Lolbin Jsc.exe compile javascript to exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1127/T1127.yaml","description":"Use jsc.exe to compile javascript code stored in scriptfile.js and output scriptfile.exe.\nhttps://lolbas-project.github.io/lolbas/Binaries/Jsc/\nhttps://www.phpied.com/make-your-javascript-a-windows-exe/\n","inputs":{"filename":{"description":"Location of the project file","type":"path","default":"PathToAtomicsFolder\\T1127\\src\\hello.js"},"jscpath":{"description":"Default location of jsc.exe","type":"path","default":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319"},"jscname":{"description":"Default name of jsc","type":"path","default":"jsc.exe"}},"dependencies":[{"description":"JavaScript code file must exist on disk at specified location (#{filename})\n"}],"source_definition_sha256":"8ccc6f1eaa5ce5f982ac082b2256711fa3c0dea784a8bc176474074e90d02372"},{"id":"3fc9fea2-871d-414d-8ef6-02e85e322b80","name":"Lolbin Jsc.exe compile javascript to dll","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1127/T1127.yaml","description":"Use jsc.exe to compile javascript code stored in Library.js and output Library.dll.\nhttps://lolbas-project.github.io/lolbas/Binaries/Jsc/\nhttps://www.phpied.com/make-your-javascript-a-windows-exe/\n","inputs":{"filename":{"description":"Location of the project file","type":"path","default":"PathToAtomicsFolder\\T1127\\src\\LibHello.js"},"jscpath":{"description":"Default location of jsc.exe","type":"path","default":"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319"},"jscname":{"description":"Default name of jsc","type":"path","default":"jsc.exe"}},"dependencies":[{"description":"JavaScript code file must exist on disk at specified location (#{filename})\n"}],"source_definition_sha256":"4690e7031b7fefad443f9f90572de5f03c3ec82d052ffb5ebdb1569e0cfdea02"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1127":"/ttp-simulation/techniques/enterprise/T1127/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1127","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}}]}}