{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1218","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"795be66fd7849bae49cc825974eb602585b815cdba9d73c4caf7747780bc7e57","description":"Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.\n\nSimilarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1218","external_id":"T1218"},{"source_name":"GTFO split","description":"GTFOBins. (2020, November 13). split. Retrieved April 18, 2022.","url":"https://gtfobins.github.io/gtfobins/split/"},{"source_name":"LOLBAS Project","description":"Oddvar Moe et al. (2022, February).  Living Off The Land Binaries, Scripts and Libraries. Retrieved March 7, 2022.","url":"https://github.com/LOLBAS-Project/LOLBAS#criteria"},{"source_name":"split man page","description":"Torbjorn Granlund, Richard M. Stallman. (2020, March null). split(1) — Linux manual page. Retrieved March 25, 2022.","url":"https://man7.org/linux/man-pages/man1/split.1.html"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1218.001","id":"T1218.001","name":"Compiled HTML File","page":"techniques/enterprise/T1218.001/"},{"key":"enterprise/T1218.002","id":"T1218.002","name":"Control Panel","page":"techniques/enterprise/T1218.002/"},{"key":"enterprise/T1218.003","id":"T1218.003","name":"CMSTP","page":"techniques/enterprise/T1218.003/"},{"key":"enterprise/T1218.004","id":"T1218.004","name":"InstallUtil","page":"techniques/enterprise/T1218.004/"},{"key":"enterprise/T1218.005","id":"T1218.005","name":"Mshta","page":"techniques/enterprise/T1218.005/"},{"key":"enterprise/T1218.007","id":"T1218.007","name":"Msiexec","page":"techniques/enterprise/T1218.007/"},{"key":"enterprise/T1218.008","id":"T1218.008","name":"Odbcconf","page":"techniques/enterprise/T1218.008/"},{"key":"enterprise/T1218.009","id":"T1218.009","name":"Regsvcs/Regasm","page":"techniques/enterprise/T1218.009/"},{"key":"enterprise/T1218.010","id":"T1218.010","name":"Regsvr32","page":"techniques/enterprise/T1218.010/"},{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","page":"techniques/enterprise/T1218.011/"},{"key":"enterprise/T1218.012","id":"T1218.012","name":"Verclsid","page":"techniques/enterprise/T1218.012/"},{"key":"enterprise/T1218.013","id":"T1218.013","name":"Mavinject","page":"techniques/enterprise/T1218.013/"},{"key":"enterprise/T1218.014","id":"T1218.014","name":"MMC","page":"techniques/enterprise/T1218.014/"},{"key":"enterprise/T1218.015","id":"T1218.015","name":"Electron Applications","page":"techniques/enterprise/T1218.015/"}],"telemetry":[{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1218","technique_page":"techniques/enterprise/T1218/","page":"detections/enterprise/T1218/","status":"rule_source_available","counts":{"sigma":135,"atlas_basic":2,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe","title":"Hidden Flag Set On File/Directory Via Chflags - MacOS","status":"test","level":"medium","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml","author":"Omar Khaled (@beacon_exe)","kind":"sigma"},{"id":"5594e67a-7f92-4a04-b65d-1a42fd824a60","title":"MSI Installation From Web","status":"test","level":"medium","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/5594e67a-7f92-4a04-b65d-1a42fd824a60.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/msiinstaller/win_msi_install_from_web.yml","author":"Stamatis Chatzimangou","kind":"sigma"},{"id":"e0b06658-7d1d-4cd3-bf15-03467507ff7c","title":"Suspicious DotNET CLR Usage Log Artifact","status":"test","level":"high","logsource":{"category":"file_event","product":"windows","definition":"Requirements: UsageLogs folder must be monitored by the sysmon configuration"},"data_path":"data/detection-rules/e0b06658-7d1d-4cd3-bf15-03467507ff7c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml","author":"frack113, omkar72, oscd.community, Wojciech Lesicki","kind":"sigma"},{"id":"760e75d8-c3b5-409b-a9bf-6130b4c4603f","title":"Self Extraction Directive File Created In Potentially Suspicious Location","status":"test","level":"medium","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/760e75d8-c3b5-409b-a9bf-6130b4c4603f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_sed_file_creation.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"409f8a98-4496-4aaa-818a-c931c0a8b832","title":"Created Files by Microsoft Sync Center","status":"test","level":"medium","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/409f8a98-4496-4aaa-818a-c931c0a8b832.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml","author":"elhoim","kind":"sigma"},{"id":"654fcc6d-840d-4844-9b07-2c3300e54a26","title":"Legitimate Application Dropped Archive","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/654fcc6d-840d-4844-9b07-2c3300e54a26.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml","author":"frack113, Florian Roth","kind":"sigma"},{"id":"f0540f7e-2db3-4432-b9e0-3965486744bc","title":"Legitimate Application Dropped Executable","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/f0540f7e-2db3-4432-b9e0-3965486744bc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe.yml","author":"frack113, Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"1cf465a1-2609-4c15-9b66-c32dbe4bfd67","title":"Legitimate Application Writing Files In Uncommon Location","status":"experimental","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/1cf465a1-2609-4c15-9b66-c32dbe4bfd67.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"7d604714-e071-49ff-8726-edeb95a70679","title":"Legitimate Application Dropped Script","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/7d604714-e071-49ff-8726-edeb95a70679.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml","author":"frack113, Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"ab90dab8-c7da-4010-9193-563528cfa347","title":"Potentially Suspicious Self Extraction Directive File Created","status":"test","level":"medium","logsource":{"product":"windows","category":"file_executable_detected"},"data_path":"data/detection-rules/ab90dab8-c7da-4010-9193-563528cfa347.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"e76c8240-d68f-4773-8880-5c6f63595aaf","title":"Time Travel Debugging Utility Usage - Image","status":"test","level":"high","logsource":{"product":"windows","category":"image_load"},"data_path":"data/detection-rules/e76c8240-d68f-4773-8880-5c6f63595aaf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_tttracer_module_load.yml","author":"Ensar Şamil, @sblmsrsn, @oscd_initiative","kind":"sigma"},{"id":"0fa66f66-e3f6-4a9c-93f8-4f2610b00171","title":"Potential DLL Sideloading Using Coregen.exe","status":"test","level":"medium","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/0fa66f66-e3f6-4a9c-93f8-4f2610b00171.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_coregen.yml","author":"frack113","kind":"sigma"},{"id":"6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984","title":"BaaUpdate.exe Suspicious DLL Load","status":"experimental","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_susp_baaupdate_dll_load.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"5205613d-2a63-4412-a895-3a2458b587b3","title":"Network Connection Initiated By AddinUtil.EXE","status":"test","level":"high","logsource":{"category":"network_connection","product":"windows"},"data_path":"data/detection-rules/5205613d-2a63-4412-a895-3a2458b587b3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_addinutil_initiated.yml","author":"Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","kind":"sigma"},{"id":"9f2cc74d-78af-4eb2-bb64-9cd1d292b87b","title":"Microsoft Sync Center Suspicious Network Connections","status":"test","level":"medium","logsource":{"product":"windows","category":"network_connection"},"data_path":"data/detection-rules/9f2cc74d-78af-4eb2-bb64-9cd1d292b87b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml","author":"elhoim","kind":"sigma"},{"id":"c649a6c7-cd8c-4a78-9c04-000fc76df954","title":"Potentially Suspicious Wuauclt Network Connection","status":"test","level":"medium","logsource":{"category":"network_connection","product":"windows","definition":"Requirements: The CommandLine field enrichment is required in order for this rule to be used."},"data_path":"data/detection-rules/c649a6c7-cd8c-4a78-9c04-000fc76df954.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"f65e22f9-819e-4f96-9c7b-498364ae7a25","title":"Potential RemoteFXvGPUDisablement.EXE Abuse","status":"test","level":"high","logsource":{"product":"windows","service":"powershell-classic","definition":"fields have to be extract from event"},"data_path":"data/detection-rules/f65e22f9-819e-4f96-9c7b-498364ae7a25.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_classic/posh_pc_remotefxvgpudisablement_abuse.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"38a7625e-b2cb-485d-b83d-aff137d859f4","title":"Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module","status":"test","level":"high","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/38a7625e-b2cb-485d-b83d-aff137d859f4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_remotefxvgpudisablement_abuse.yml","author":"Nasreddine Bencherchali (Nextron Systems), frack113","kind":"sigma"},{"id":"fe5ce7eb-dad8-467c-84a9-31ec23bd644a","title":"SyncAppvPublishingServer Bypass Powershell Restriction - PS Module","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/fe5ce7eb-dad8-467c-84a9-31ec23bd644a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml","author":"Ensar Şamil, @sblmsrsn, OSCD Community","kind":"sigma"},{"id":"cacef8fc-9d3d-41f7-956d-455c6e881bc5","title":"Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"},"data_path":"data/detection-rules/cacef8fc-9d3d-41f7-956d-455c6e881bc5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_remotefxvgpudisablement_abuse.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"dddfebae-c46f-439c-af7a-fdb6bde90218","title":"SyncAppvPublishingServer Execution to Bypass Powershell Restriction","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/dddfebae-c46f-439c-af7a-fdb6bde90218.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml","author":"Ensar Şamil, @sblmsrsn, OSCD Community","kind":"sigma"},{"id":"631b22a4-70f4-4e2f-9ea8-42f84d9df6d8","title":"Suspicious AddinUtil.EXE CommandLine Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/631b22a4-70f4-4e2f-9ea8-42f84d9df6d8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml","author":"Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","kind":"sigma"},{"id":"b5746143-59d6-4603-8d06-acbd60e166ee","title":"Uncommon Child Process Of AddinUtil.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b5746143-59d6-4603-8d06-acbd60e166ee.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml","author":"Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","kind":"sigma"},{"id":"4f2cd9b6-4a17-440f-bb2a-687abb65993a","title":"Uncommon AddinUtil.EXE CommandLine Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4f2cd9b6-4a17-440f-bb2a-687abb65993a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml","author":"Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","kind":"sigma"},{"id":"6120ac2a-a34b-42c0-a9bd-1fb9f459f348","title":"AddinUtil.EXE Execution From Uncommon Directory","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6120ac2a-a34b-42c0-a9bd-1fb9f459f348.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml","author":"Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","kind":"sigma"},{"id":"7efd2c8d-8b18-45b7-947d-adfe9ed04f61","title":"AgentExecutor PowerShell Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7efd2c8d-8b18-45b7-947d-adfe9ed04f61.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml","author":"Nasreddine Bencherchali (Nextron Systems), memory-shards","kind":"sigma"},{"id":"c0b40568-b1e9-4b03-8d6c-b096da6da9ab","title":"Suspicious AgentExecutor PowerShell Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c0b40568-b1e9-4b03-8d6c-b096da6da9ab.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml","author":"Nasreddine Bencherchali (Nextron Systems), memory-shards","kind":"sigma"},{"id":"9c7e131a-0f2c-4ae0-9d43-b04f4e266d43","title":"Uncommon Child Process Of Appvlp.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9c7e131a-0f2c-4ae0-9d43-b04f4e266d43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_appvlp_uncommon_child_process.yml","author":"Sreeman","kind":"sigma"},{"id":"f24bcaea-0cd1-11eb-adc1-0242ac120002","title":"Uncommon  Assistive Technology Applications Execution Via AtBroker.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f24bcaea-0cd1-11eb-adc1-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml","author":"Mateusz Wydra, oscd.community","kind":"sigma"},{"id":"9f38c1db-e2ae-40bf-81d0-5b68f73fb512","title":"Suspicious BitLocker Access Agent Update Utility Execution","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9f38c1db-e2ae-40bf-81d0-5b68f73fb512.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_baaupdate_susp_child_process.yml","author":"andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"811f459f-9231-45d4-959a-0266c6311987","title":"Suspicious Child Process Of BgInfo.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/811f459f-9231-45d4-959a-0266c6311987.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"aaf46cdc-934e-4284-b329-34aa701e3771","title":"Uncommon Child Process Of BgInfo.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/aaf46cdc-934e-4284-b329-34aa701e3771.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml","author":"Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community","kind":"sigma"},{"id":"7f2376f9-42ee-4dfc-9360-fecff9a88fc8","title":"BitLockerTogo.EXE Execution","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7f2376f9-42ee-4dfc-9360-fecff9a88fc8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bitlockertogo_execution.yml","author":"Josh Nickels, mttaggart","kind":"sigma"},{"id":"b5c7395f-e501-4a08-94d4-57fe7a9da9d2","title":"Potential Binary Proxy Execution Via Cdb.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b5c7395f-e501-4a08-94d4-57fe7a9da9d2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml","author":"Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"242301bc-f92f-4476-8718-78004a6efd9f","title":"DLL Loaded via CertOC.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/242301bc-f92f-4476-8718-78004a6efd9f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"84232095-ecca-4015-b0d7-7726507ee793","title":"Suspicious DLL Loaded via CertOC.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/84232095-ecca-4015-b0d7-7726507ee793.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"6c6d9280-e6d0-4b9d-80ac-254701b64916","title":"Potential NTLM Coercion Via Certutil.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6c6d9280-e6d0-4b9d-80ac-254701b64916.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"21dd6d38-2b18-4453-9404-a0fe4a0cc288","title":"Curl Download And Execute Combination","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/21dd6d38-2b18-4453-9404-a0fe4a0cc288.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml","author":"Sreeman, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"8e0bb260-d4b2-4fff-bb8d-3f82118e6892","title":"Potentially Suspicious CMD Shell Output Redirect","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8e0bb260-d4b2-4fff-bb8d-3f82118e6892.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_redirection_susp_folder.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"f37aba28-a9e6-4045-882c-d5004043b337","title":"Potential Arbitrary File Download Via Cmdl32.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f37aba28-a9e6-4045-882c-d5004043b337.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml","author":"frack113","kind":"sigma"},{"id":"dfa03a09-8b92-4d83-8e74-f72839b1c407","title":"Potentially Suspicious Child Processes Spawned by ConHost","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/dfa03a09-8b92-4d83-8e74-f72839b1c407.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"40b95d31-1afc-469e-8d34-9a3a667d058e","title":"Suspicious Csi.exe Usage","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/40b95d31-1afc-469e-8d34-9a3a667d058e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_csi_execution.yml","author":"Konstantin Grishchenko, oscd.community","kind":"sigma"},{"id":"b2309017-4235-44fe-b5af-b15363011957","title":"Uncommon Child Process Of Defaultpack.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b2309017-4235-44fe-b5af-b15363011957.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_defaultpack_uncommon_child_process.yml","author":"frack113","kind":"sigma"},{"id":"b8b1b304-a60f-4999-9a6e-c547bde03ffd","title":"DeviceCredentialDeployment Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b8b1b304-a60f-4999-9a6e-c547bde03ffd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_device_credential_deployment.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"90d50722-0483-4065-8e35-57efaadd354d","title":"Arbitrary MSI Download Via Devinit.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/90d50722-0483-4065-8e35-57efaadd354d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"9f546b25-5f12-4c8d-8532-5893dcb1e4b8","title":"Potentially Suspicious Child Process Of DiskShadow.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9f546b25-5f12-4c8d-8532-5893dcb1e4b8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"1dde5376-a648-492e-9e54-4241dd9b0c7f","title":"Diskshadow Script Mode - Uncommon Script Extension Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1dde5376-a648-492e-9e54-4241dd9b0c7f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_ext.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"fa1a7e52-3d02-435b-81b8-00da14dd66c1","title":"Diskshadow Script Mode - Execution From Potential Suspicious Location","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fa1a7e52-3d02-435b-81b8-00da14dd66c1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_location.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"81ebd28b-9607-4478-bf06-974ed9d53ed7","title":"Potential Application Whitelisting Bypass via Dnx.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/81ebd28b-9607-4478-bf06-974ed9d53ed7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml","author":"Beyu Denis, oscd.community","kind":"sigma"},{"id":"d80d5c81-04ba-45b4-84e4-92eba40e0ad3","title":"Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d80d5c81-04ba-45b4-84e4-92eba40e0ad3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml","author":"Beyu Denis, oscd.community","kind":"sigma"},{"id":"9257c05b-4a4a-48e5-a670-b7b073cf401b","title":"Binary Proxy Execution Via Dotnet-Trace.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9257c05b-4a4a-48e5-a670-b7b073cf401b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dotnet_trace_lolbin_execution.yml","author":"Jimmy Bayne (@bohops)","kind":"sigma"},{"id":"53d8d3e1-ca33-4012-adf3-e05a4d652e34","title":"Process Memory Dump Via Dotnet-Dump","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/53d8d3e1-ca33-4012-adf3-e05a4d652e34.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dotnetdump_memory_dump.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"01c42d3c-242d-4655-85b2-34f1739632f7","title":"Potentially Over Permissive Permissions Granted Using Dsacls.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/01c42d3c-242d-4655-85b2-34f1739632f7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"bac9fb54-2da7-44e9-988f-11e9a5edbc0c","title":"Potential Password Spraying Attempt Using Dsacls.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bac9fb54-2da7-44e9-988f-11e9a5edbc0c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dsacls_password_spray.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"60f16a96-db70-42eb-8f76-16763e333590","title":"New Capture Session Launched Via DXCap.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/60f16a96-db70-42eb-8f76-16763e333590.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dxcap_arbitrary_binary_execution.yml","author":"Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9f107a84-532c-41af-b005-8d12a607639f","title":"Potentially Suspicious Cabinet File Expansion","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9f107a84-532c-41af-b005-8d12a607639f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml","author":"Bhabesh Raj, X__Junior (Nextron Systems)","kind":"sigma"},{"id":"587254ee-a24b-4335-b3cd-065c0f1f4baa","title":"Remote File Download Via Findstr.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/587254ee-a24b-4335-b3cd-065c0f1f4baa.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_findstr_download.yml","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"04936b66-3915-43ad-a8e5-809eadfd1141","title":"Insensitive Subfolder Search Via Findstr.EXE","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/04936b66-3915-43ad-a8e5-809eadfd1141.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"52cad028-0ff0-4854-8f67-d25dfcbc78b4","title":"HTML Help HH.EXE Suspicious Child Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/52cad028-0ff0-4854-8f67-d25dfcbc78b4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml","author":"Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e8a95b5e-c891-46e2-b33a-93937d3abc31","title":"Suspicious HH.EXE Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e8a95b5e-c891-46e2-b33a-93937d3abc31.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml","author":"Maxim Pavlunin","kind":"sigma"},{"id":"90dcf730-1b71-4ae7-9ffc-6fcf62bd0132","title":"Suspicious ZipExec Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/90dcf730-1b71-4ae7-9ffc-6fcf62bd0132.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_zipexec.yml","author":"frack113","kind":"sigma"},{"id":"b2b048b0-7857-4380-b0fb-d3f0ab820b71","title":"Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b2b048b0-7857-4380-b0fb-d3f0ab820b71.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"863218bd-c7d0-4c52-80cd-0a96c09f54af","title":"Arbitrary File Download Via IMEWDBLD.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/863218bd-c7d0-4c52-80cd-0a96c09f54af.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_imewbdld_download.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"ce7cf472-6fcc-490a-9481-3786840b5d9b","title":"InfDefaultInstall.exe .inf Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ce7cf472-6fcc-490a-9481-3786840b5d9b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts.yml","author":"frack113","kind":"sigma"},{"id":"75edd216-1939-4c73-8d61-7f3a0d85b5cc","title":"File Download Via InstallUtil.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/75edd216-1939-4c73-8d61-7f3a0d85b5cc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_installutil_download.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"6f535e01-ca1f-40be-ab8d-45b19c0c8b7f","title":"Import LDAP Data Interchange Format File Via Ldifde.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6f535e01-ca1f-40be-ab8d-45b19c0c8b7f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml","author":"@gott_cyber","kind":"sigma"},{"id":"6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6","title":"Uncommon Link.EXE Parent Process","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6","title":"Devtoolslauncher.exe Executes Specified Binary","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml","author":"Beyu Denis, oscd.community (rule), @_felamos (idea)","kind":"sigma"},{"id":"1e59c230-6670-45bf-83b0-98903780607e","title":"Gpscript Execution","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/1e59c230-6670-45bf-83b0-98903780607e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml","author":"frack113","kind":"sigma"},{"id":"d3bf399f-b0cf-4250-8bb4-dfc192ab81dc","title":"Ie4uinit Lolbin Use From Invalid Path","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/d3bf399f-b0cf-4250-8bb4-dfc192ab81dc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml","author":"frack113","kind":"sigma"},{"id":"729ce0ea-5d8f-4769-9762-e35de441586d","title":"MpiExec Lolbin","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/729ce0ea-5d8f-4769-9762-e35de441586d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_mpiexec.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"646bc99f-6682-4b47-a73a-17b1b64c9d34","title":"Execute Files with Msdeploy.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/646bc99f-6682-4b47-a73a-17b1b64c9d34.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml","author":"Beyu Denis, oscd.community","kind":"sigma"},{"id":"cec8e918-30f7-4e2d-9bfa-a59cc97ae60f","title":"OpenWith.exe Executes Specified Binary","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/cec8e918-30f7-4e2d-9bfa-a59cc97ae60f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_openwith.yml","author":"Beyu Denis, oscd.community (rule), @harr0ey (idea)","kind":"sigma"},{"id":"b97cd4b1-30b8-4a9d-bd72-6293928d52bc","title":"Indirect Command Execution By Program Compatibility Wizard","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b97cd4b1-30b8-4a9d-bd72-6293928d52bc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml","author":"A. Sungurov , oscd.community","kind":"sigma"},{"id":"6004abd0-afa4-4557-ba90-49d172e0a299","title":"Execute Pcwrun.EXE To Leverage Follina","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6004abd0-afa4-4557-ba90-49d172e0a299.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"cd3d1298-eb3b-476c-ac67-12847de55813","title":"DLL Execution via Rasautou.exe","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation","definition":"Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud)"},"data_path":"data/detection-rules/cd3d1298-eb3b-476c-ac67-12847de55813.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml","author":"Julia Fomina, oscd.community","kind":"sigma"},{"id":"1c8774a0-44d4-4db0-91f8-e792359c70bd","title":"REGISTER_APP.VBS Proxy Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1c8774a0-44d4-4db0-91f8-e792359c70bd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_register_app.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"cd71385d-fd9b-4691-9b98-2b1f7e508714","title":"Lolbin Runexehelper Use As Proxy","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/cd71385d-fd9b-4691-9b98-2b1f7e508714.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml","author":"frack113","kind":"sigma"},{"id":"64760eef-87f7-4ed3-93fd-655668ea9420","title":"Use of Scriptrunner.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/64760eef-87f7-4ed3-93fd-655668ea9420.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_scriptrunner.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"a85ffc3a-e8fd-4040-93bf-78aff284d801","title":"Use Of The SFTP.EXE Binary As A LOLBIN","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a85ffc3a-e8fd-4040-93bf-78aff284d801.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_sftp.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"fbd7c32d-db2a-4418-b92c-566eb8911133","title":"SyncAppvPublishingServer Execute Arbitrary PowerShell Code","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fbd7c32d-db2a-4418-b92c-566eb8911133.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml","author":"frack113","kind":"sigma"},{"id":"36475a7d-0f6d-4dce-9b01-6aeb473bbaf1","title":"SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/36475a7d-0f6d-4dce-9b01-6aeb473bbaf1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml","author":"frack113","kind":"sigma"},{"id":"0b4ae027-2a2d-4b93-8c7e-962caaba5b2a","title":"Time Travel Debugging Utility Usage","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/0b4ae027-2a2d-4b93-8c7e-962caaba5b2a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml","author":"Ensar Şamil, @sblmsrsn, @oscd_initiative","kind":"sigma"},{"id":"727454c0-d851-48b0-8b89-385611ab0704","title":"Lolbin Unregmp2.exe Use As Proxy","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/727454c0-d851-48b0-8b89-385611ab0704.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_unregmp2.yml","author":"frack113","kind":"sigma"},{"id":"b30a8bc5-e21b-4ca2-9420-0a94019ac56a","title":"Use of VisualUiaVerifyNative.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b30a8bc5-e21b-4ca2-9420-0a94019ac56a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","kind":"sigma"},{"id":"28c8f68b-098d-45af-8d43-8089f3e35403","title":"Potential Register_App.Vbs LOLScript Abuse","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/28c8f68b-098d-45af-8d43-8089f3e35403.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolscript_register_app.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"1dd05363-104e-4b4a-b963-196a534b03a1","title":"Potential Suspicious Mofcomp Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1dd05363-104e-4b4a-b963-196a534b03a1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"46123129-1024-423e-9fae-43af4a0fa9a5","title":"File Download Via Windows Defender MpCmpRun.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/46123129-1024-423e-9fae-43af4a0fa9a5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml","author":"Matthew Matchen","kind":"sigma"},{"id":"9c8c7000-3065-44a8-a555-79bcba5d9955","title":"MSDT Execution Via Answer File","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9c8c7000-3065-44a8-a555-79bcba5d9955.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msdt_answer_file_exec.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"7a74da6b-ea76-47db-92cc-874ad90df734","title":"Suspicious MSDT Parent Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7a74da6b-ea76-47db-92cc-874ad90df734.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml","author":"Nextron Systems","kind":"sigma"},{"id":"e84d89c4-f544-41ca-a6af-4b92fd38b023","title":"Arbitrary File Download Via MSEDGE_PROXY.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e84d89c4-f544-41ca-a6af-4b92fd38b023.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msedge_proxy_download.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"af5732ed-764e-489d-826d-0447c8b36242","title":"Windows MSIX Package Support Framework AI_STUBS Execution","status":"experimental","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/af5732ed-764e-489d-826d-0447c8b36242.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msix_ai_stub_execution.yml","author":"Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"459f2f98-397b-4a4a-9f47-6a5ec2f1c69d","title":"Arbitrary File Download Via MSOHTMED.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/459f2f98-397b-4a4a-9f47-6a5ec2f1c69d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msohtmed_download.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"3b3c7f55-f771-4dd6-8a6e-08d057a17caf","title":"Arbitrary File Download Via MSPUB.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/3b3c7f55-f771-4dd6-8a6e-08d057a17caf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mspub_download.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"02b18447-ea83-4b1b-8805-714a8a34546a","title":"Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/02b18447-ea83-4b1b-8805-714a8a34546a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_offlinescannershell_mpclient_sideloading.yml","author":"frack113","kind":"sigma"},{"id":"222720a7-047f-4054-baa5-bab9be757db0","title":"PowerShell MSI Install via WindowsInstaller COM From Remote Location","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/222720a7-047f-4054-baa5-bab9be757db0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_comobject_msi_remote.yml","author":"Meroujan Antonyan (vx3r)","kind":"sigma"},{"id":"a6fc3c46-23b8-4996-9ea2-573f4c4d88c5","title":"RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/a6fc3c46-23b8-4996-9ea2-573f4c4d88c5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse.yml","author":"frack113","kind":"sigma"},{"id":"b124ddf4-778d-418e-907f-6dd3fc0d31cd","title":"Arbitrary File Download Via PresentationHost.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b124ddf4-778d-418e-907f-6dd3fc0d31cd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_presentationhost_download.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d22e2925-cfd8-463f-96f6-89cec9d9bc5f","title":"XBAP Execution From Uncommon Locations Via PresentationHost.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d22e2925-cfd8-463f-96f6-89cec9d9bc5f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_presentationhost_uncommon_location_exec.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"a20391f8-76fb-437b-abc0-dba2df1952c6","title":"Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a20391f8-76fb-437b-abc0-dba2df1952c6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"2fcda7e2-8c57-4904-86ac-37fc3157e09d","title":"Sensitive File Dump Via Print.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2fcda7e2-8c57-4904-86ac-37fc3157e09d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files.yml","author":"Ayush Anand (Securityinbits)","kind":"sigma"},{"id":"bafac3d6-7de9-4dd9-8874-4a1194b493ed","title":"Abusing Print Executable","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bafac3d6-7de9-4dd9-8874-4a1194b493ed.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative","kind":"sigma"},{"id":"104cdb48-a7a8-4ca7-a453-32942c6e5dcb","title":"File Download Using ProtocolHandler.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/104cdb48-a7a8-4ca7-a453-32942c6e5dcb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_protocolhandler_download.yml","author":"frack113","kind":"sigma"},{"id":"7f5d1c9a-3e83-48df-95a7-2b98aae6c13c","title":"Potential Provlaunch.EXE Binary Proxy Execution Abuse","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7f5d1c9a-3e83-48df-95a7-2b98aae6c13c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml","author":"Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"f9999590-1f94-4a34-a91e-951e47bedefd","title":"Suspicious Provlaunch.EXE Child Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f9999590-1f94-4a34-a91e-951e47bedefd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25","title":"Potential Provisioning Registry Key Abuse For Binary Proxy Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml","author":"Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"340a090b-c4e9-412e-bb36-b4b16fe96f9b","title":"Renamed ZOHO Dctask64 Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/340a090b-c4e9-412e-bb36-b4b16fe96f9b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_dctask64.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"643bdcac-8b82-49f4-9fd9-25a90b929f3b","title":"Renamed MegaSync Execution","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/643bdcac-8b82-49f4-9fd9-25a90b929f3b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_megasync.yml","author":"Sittikorn S","kind":"sigma"},{"id":"65c3ca2c-525f-4ced-968e-246a713d164f","title":"Visual Studio NodejsTools PressAnyKey Renamed Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/65c3ca2c-525f-4ced-968e-246a713d164f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_pressanykey.yml","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"1d174d38-8fda-4081-a9b6-56d9763c0cd8","title":"Scheduled Task Creation with Curl and PowerShell Execution Combo","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1d174d38-8fda-4081-a9b6-56d9763c0cd8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_schtasks_curl_and_powershell_combo.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"f3d39c45-de1a-4486-a687-ab126124f744","title":"Sdiagnhost Calling Suspicious Child Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f3d39c45-de1a-4486-a687-ab126124f744.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml","author":"Nextron Systems, @Kostastsale","kind":"sigma"},{"id":"835e75bf-4bfd-47a4-b8a6-b766cac8bcb7","title":"Uncommon Child Process Of Setres.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/835e75bf-4bfd-47a4-b8a6-b766cac8bcb7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_setres_uncommon_child_process.yml","author":"@gott_cyber, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"78f10490-f2f4-4d19-a75b-4e0683bf3b8d","title":"Suspicious Speech Runtime Binary Child Process","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/78f10490-f2f4-4d19-a75b-4e0683bf3b8d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_speechruntime_child_process.yml","author":"andrewdanis","kind":"sigma"},{"id":"1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c","title":"Arbitrary File Download Via Squirrel.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_squirrel_download.yml","author":"Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community","kind":"sigma"},{"id":"45239e6a-b035-4aaf-b339-8ad379fcb67e","title":"Process Proxy Execution Via Squirrel.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/45239e6a-b035-4aaf-b339-8ad379fcb67e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community","kind":"sigma"},{"id":"7d6d30b8-5b91-4b90-a891-46cccaf29598","title":"Program Executed Using Proxy/Local Command Via SSH.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7d6d30b8-5b91-4b90-a891-46cccaf29598.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml","author":"frack113, Nasreddine Bencherchali","kind":"sigma"},{"id":"961e0abb-1b1e-4c84-a453-aafe56ad0d34","title":"Execution via stordiag.exe","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/961e0abb-1b1e-4c84-a453-aafe56ad0d34.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_stordiag_susp_child_process.yml","author":"Austin Songer (@austinsonger)","kind":"sigma"},{"id":"180c7c5c-d64b-4a63-86e9-68910451bc8b","title":"Potential File Download Via MS-AppInstaller Protocol Handler","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/180c7c5c-d64b-4a63-86e9-68910451bc8b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_ms_appinstaller_download.yml","author":"Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"3a6586ad-127a-4d3b-a677-1e6eacdf8fde","title":"Windows Shell/Scripting Processes Spawning Suspicious Programs","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/3a6586ad-127a-4d3b-a677-1e6eacdf8fde.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml","author":"Florian Roth (Nextron Systems), Tim Shelton","kind":"sigma"},{"id":"634b00d5-ccc3-4a06-ae3b-0ec8444dd51b","title":"Malicious Windows Script Components File Execution by TAEF Detection","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/634b00d5-ccc3-4a06-ae3b-0ec8444dd51b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml","author":"Agro (@agro_sev) oscd.community","kind":"sigma"},{"id":"15c7904e-6ad1-4a45-9b46-5fb25df37fd2","title":"Malicious PE Execution by Microsoft Visual Studio Debugger","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/15c7904e-6ad1-4a45-9b46-5fb25df37fd2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml","author":"Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community","kind":"sigma"},{"id":"0bbc6369-43e3-453d-9944-cae58821c173","title":"Execution via WorkFolders.exe","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0bbc6369-43e3-453d-9944-cae58821c173.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_workfolders.yml","author":"Maxime Thiebaut (@0xThiebaut)","kind":"sigma"},{"id":"7cce6fc8-a07f-4d84-a53e-96e1879843c9","title":"Potential Binary Impersonating Sysinternals Tools","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7cce6fc8-a07f-4d84-a53e-96e1879843c9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"d06be4b9-8045-428b-a567-740a26d9db25","title":"Verclsid.exe Runs COM Object","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d06be4b9-8045-428b-a567-740a26d9db25.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml","author":"Victor Sergeev, oscd.community","kind":"sigma"},{"id":"5a3164f2-b373-4152-93cf-090b13c12d27","title":"Potentially Suspicious Child Process Of VsCode","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5a3164f2-b373-4152-93cf-090b13c12d27.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ac1c92b4-ac81-405a-9978-4604d78cc47e","title":"Potential Binary Proxy Execution Via VSDiagnostics.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ac1c92b4-ac81-405a-9978-4604d78cc47e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vsdiagnostics_execution_proxy.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"43103702-5886-11ed-9b6a-0242ac120002","title":"Suspicious Vsls-Agent Command With AgentExtensionPath Load","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/43103702-5886-11ed-9b6a-0242ac120002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml","author":"bohops","kind":"sigma"},{"id":"bcfece3d-56fe-4545-9931-3b8e92927db1","title":"Winrs Local Command Execution","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bcfece3d-56fe-4545-9931-3b8e92927db1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_winrs_local_command_execution.yml","author":"Liran Ravich, Nasreddine Bencherchali","kind":"sigma"},{"id":"9cfc00b6-bfb7-49ce-9781-ef78503154bb","title":"Wlrmdr.EXE Uncommon Argument Or Child Process","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9cfc00b6-bfb7-49ce-9781-ef78503154bb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml","author":"frack113, manasmbellani","kind":"sigma"},{"id":"2267fe65-0681-42ad-9a6d-46553d3f3480","title":"WSL Child Process Anomaly","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2267fe65-0681-42ad-9a6d-46553d3f3480.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"af77cf95-c469-471c-b6a0-946c685c4798","title":"Proxy Execution Via Wuauclt.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/af77cf95-c469-471c-b6a0-946c685c4798.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wuauclt_dll_loading.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team","kind":"sigma"},{"id":"53d4bb30-3f36-4e8a-b078-69d36c4a79ff","title":"COM Object Execution via Xwizard.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/53d4bb30-3f36-4e8a-b078-69d36c4a79ff.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_xwizard_runwizard_com_object_exec.yml","author":"Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9577edbb-851f-4243-8c91-1d5b50c1a39b","title":"Atbroker Registry Change","status":"test","level":"medium","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/9577edbb-851f-4243-8c91-1d5b50c1a39b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml","author":"Mateusz Wydra, oscd.community","kind":"sigma"},{"id":"7021255e-5db3-4946-a8b9-0ba7a4644a69","title":"Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows","definition":"Requirements: The registry key \"\\SOFTWARE\\Microsoft\\Provisioning\\Commands\\\" and its subkey must be monitored"},"data_path":"data/detection-rules/7021255e-5db3-4946-a8b9-0ba7a4644a69.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"fc014922-5def-4da9-a0fc-28c973f41bfb","title":"Execution DLL of Choice Using WAB.EXE","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/fc014922-5def-4da9-a0fc-28c973f41bfb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml","author":"oscd.community, Natalia Shornikova","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1218-1","technique_id":"T1218","title":"T1218 System Binary Proxy Execution","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#execution","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":63,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L63","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"1fe4afce3b7ea6ff725bd4afa5c45813187afe8056fee5e868d05626d8548e5e","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(process_name IN proxy_execution_binaries) AND command_line MATCHES known_abuse_patterns -> ALERT","log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Application-Control Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#19-application-control-logs"}]},{"id":"atlas-basic-t1218-2","technique_id":"T1218","title":"T1218 System Binary Proxy Execution","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":102,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L102","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"c46e7eec1185f4a7619e097d9ac85a6e9c70be2ce4137bf37a6f8f522d5a44f4","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(proxy_execution_binary) AND command_line MATCHES known_abuse_signature -> ALERT","log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Application-Control Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#19-application-control-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1218-1","technique_id":"T1218","title":"Trusted system binary launches unexpected content — T1218 System Binary Proxy Execution","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#trusted-binary-proxy-execution","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":45,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L45","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"0e8cba3fc709a4d6ac10b49a5fee5b101ad6e25fb077d29a97f8e1abd889bfa4","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"parent-child process relationship and command context.","expected_behavior":"trusted binaries execute a limited set of recurring children or resources.","deviation":"an otherwise common binary forms a rare edge or conditional combination.","anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"}],"log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Application-Control Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#19-application-control-logs"}],"context_references":[{"title":"Volt Typhoon joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa24-038a-volt-typhoon.pdf"},{"title":"original source","url":"https://www.fbi.gov/file-repository/cyber-alerts/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure.pdf"}]}],"anomaly_types":[{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"},{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"}],"strategies":[{"id":"DET0081","name":"Detection of Proxy Execution via Trusted Signed Binaries Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0081","stix_id":"x-mitre-detection-strategy--ce0b969a-1411-4b6f-a6aa-c31ef6fe6727","relationship_id":"relationship--e9264dc5-3daa-4e0b-9021-1df1fdd58b67","description":"","analytics":[{"id":"AN0226","name":"Analytic 0226","guidance":"Execution of trusted, Microsoft-signed binaries such as `rundll32.exe`, `msiexec.exe`, or `regsvr32.exe` used to execute externally hosted, unsigned, or suspicious payloads through command-line parameters or network retrieval.","url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0226","platforms":["Windows"],"tuning":[{"field":"ParentProcessName","description":"Used to profile unexpected parent-child relationships (e.g., regsvr32.exe not launched by explorer.exe)"},{"field":"SignedBinaryList","description":"List of known signed binaries allowed for execution (e.g., msiexec.exe, regsvr32.exe)"},{"field":"CommandLineRegex","description":"Regex to match suspicious arguments, such as URLs, script paths, or DLL entrypoints"},{"field":"RemoteDomainAllowlist","description":"Filter to suppress activity contacting legitimate enterprise domains"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0226","source_url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0226","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0226","source_url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0226","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0226","source_url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0226","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN0227","name":"Analytic 0227","guidance":"Execution of trusted system binaries (e.g., `split`, `tee`, `bash`, `env`) used in uncommon sequences or chained behaviors to execute malicious payloads or perform actions inconsistent with normal system or script behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0227","platforms":["Linux"],"tuning":[{"field":"TrustedBinaryList","description":"Binaries like `split`, `tee`, `env`, `awk`, `gzip`, often used in benign scripts"},{"field":"AnomalyScore","description":"Outlier model for process tree and command arguments"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0227","source_url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0227","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"auditd:SYSCALL","channel":"connect","platforms":["Linux"],"analytic_id":"AN0227","source_url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0227","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN0228","name":"Analytic 0228","guidance":"Use of system binaries such as `osascript`, `bash`, or `curl` to download or execute unsigned code or files in conjunction with application proxying.","url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0228","platforms":["macOS"],"tuning":[{"field":"TrustedUtilityList","description":"macOS binary whitelist including `/usr/bin/osascript`, `/bin/bash`, `/usr/bin/curl`"},{"field":"SignedToUnsignedTransition","description":"Used to detect proxy execution from signed binary to unsigned payload"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"exec of osascript, bash, curl with suspicious parameters","platforms":["macOS"],"analytic_id":"AN0228","source_url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0228","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"macos:osquery","channel":"execution of trusted tools interacting with external endpoints","platforms":["macOS"],"analytic_id":"AN0228","source_url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0228","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) lnk files used for persistence have abused the Windows Update Client (<code>wuauclt.exe</code>) to execute a malicious DLL.(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)","relationship_id":"relationship--883e2f79-5bf5-4e08-bb83-f1cd36907958","references":[{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"Qualys LolZarus","description":"Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"\n[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used native tools and processes including living off the land binaries or “LOLBins\" to maintain and expand access to the victim networks.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--9d201e67-fc71-41a1-9d92-b8d743d86a12","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]}],"mitigations":[{"id":"M1021","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M1021","kind":"course-of-action","description":"Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.","relationship_id":"relationship--da5a2ac1-5e59-42ef-98c4-0d24597a32fb","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Restrict execution of particularly vulnerable binaries to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage.","relationship_id":"relationship--6dc1f5ca-8881-4d06-b192-7bc502ea94ce","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.","relationship_id":"relationship--3fdff7fb-837d-4e2f-acd2-c43c933d4322","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network.","relationship_id":"relationship--95e4e360-b867-48b4-a494-d9d148232b70","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Many native binaries may not be necessary within a given environment.","relationship_id":"relationship--c8c7f580-982a-4efc-8a2a-e007e7f07220","references":[]},{"id":"M1050","name":"Exploit Protection","url":"https://attack.mitre.org/mitigations/M1050","kind":"course-of-action","description":"Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using using trusted binaries to bypass application control.","relationship_id":"relationship--1f1de0ea-581b-4b41-953f-1b8f552f84e7","references":[]}],"candidates":[{"id":"0e1483ba-8f0c-425d-b8c6-42736e058eaa","name":"DiskShadow Command Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":2,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Emulates attack with a DiskShadow.exe (LOLBIN installed by default on Windows) being used to execute arbitrary commands Reference: https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/\n","inputs":{"txt_payload":{"description":"txt to execute","type":"path","default":"PathToAtomicsFolder\\T1218\\src\\T1218.txt"},"dspath":{"description":"Default location of DiskShadow.exe","type":"path","default":"C:\\Windows\\System32\\diskshadow.exe"}},"dependencies":[{"description":"txt file must exist on disk at specified location (#{txt_payload})"},{"description":"DiskShadow.exe must exist on disk at specified location (#{dspath})"}],"source_definition_sha256":"1fe1d0bcd794a2a6683dced3b13e6527c9b690867f8bb735073c0ac5de90ed9c"},{"id":"13c0804e-615e-43ad-b223-2dfbacd0b0b3","name":"Lolbas ie4uinit.exe use as proxy","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Executes commands from a specially prepared ie4uinit.inf file.\nPoc from : https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/\nReference: https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/\n","inputs":{"Path_inf":{"description":"Path to the cab file","type":"path","default":"PathToAtomicsFolder\\T1218\\src\\ieuinit.inf"},"Path_ie4uinit":{"description":"Path to ie4uinit.exe","type":"path","default":"c:\\windows\\system32\\ie4uinit.exe"}},"dependencies":[{"description":"ieuinit.inf must exist on disk at specified location (#{Path_inf})\n"}],"source_definition_sha256":"ab528c20cbe64c0c7af16b6deff96addd277584b3a7bcf59c71e6b280a2f435d"},{"id":"49fbd548-49e9-4bb7-94a6-3769613912b8","name":"Load Arbitrary DLL via Wuauclt (Windows Update Client)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"This test uses Wuauclt to load an arbitrary DLL. Upon execution with the default inputs, calculator.exe will be launched. \nSee https://dtm.uk/wuauclt/\n","inputs":{"arbitrary_dll":{"description":"Path of DLL to be loaded","type":"string","default":"PathToAtomicsFolder\\T1218\\bin\\calc.dll"}},"dependencies":[{"description":"DLL to load must exist on disk as specified location (#{arbitrary_dll})\n"}],"source_definition_sha256":"b49849d011d2d2e4643d4be41b7536586784cc31d170992cc7d166e04297b9a4"},{"id":"4cc40fd7-87b8-4b16-b2d7-57534b86b911","name":"Renamed Microsoft.Workflow.Compiler.exe Payload Executions","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Emulates attack with a renamed Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe\n","inputs":{"xml_payload":{"description":"XML to execution","type":"path","default":"PathToAtomicsFolder\\T1218\\src\\T1218.xml"},"renamed_binary":{"description":"renamed Microsoft.Workflow.Compiler","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\svchost.exe"},"mwcpath":{"description":"Default location of Microsoft.Workflow.Compiler.exe","type":"path","default":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319"},"mwcname":{"description":"Default name of microsoft.workflow.compiler.exe","type":"path","default":"microsoft.workflow.compiler.exe"}},"dependencies":[{"description":".Net must be installed for this test to work correctly.\n"}],"source_definition_sha256":"0dfcae7163beed779032cf6942f9e1decf038b0ce92610d514acbbccdd896298"},{"id":"54ad7d5a-a1b5-472c-b6c4-f8090fb2daef","name":"InfDefaultInstall.exe .inf Execution","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Test execution of a .inf using InfDefaultInstall.exe\n\nReference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Infdefaultinstall.yml\n","inputs":{"inf_to_execute":{"description":"Local location of inf file","type":"string","default":"PathToAtomicsFolder\\T1218\\src\\Infdefaultinstall.inf"}},"dependencies":[{"description":"INF file must exist on disk at specified location (#{inf_to_execute})\n"}],"source_definition_sha256":"015a0826b931a96f87709d1c4523f91faeee174c8cc788a1242ec67d87ede5dc"},{"id":"5bcda9cd-8e85-48fa-861d-b5a85d91d48c","name":"Lolbin Gpscript logon option","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Executes logon scripts configured in Group Policy.\nhttps://lolbas-project.github.io/lolbas/Binaries/Gpscript/\nhttps://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/\n","inputs":{},"dependencies":[],"source_definition_sha256":"d71234f9095ae1123c481afb4cb431e33c24318119649b2f78f701e20674a32b"},{"id":"7816c252-b728-4ea6-a683-bd9441ca0b71","name":"System Binary Proxy Execution - Wlrmdr Lolbin","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Use wlrmdr(Windows Logon Reminder executable) as a proxy binary to evade defensive countermeasures","inputs":{"payload_path":{"description":"Path to the executable","type":"String","default":"C:\\Windows\\System32\\calc.exe"}},"dependencies":[],"source_definition_sha256":"2235807e5900c6ff4a9e0b9b30d0d040f712c9032487601796c5ace832fe359f"},{"id":"7cbb0f26-a4c1-4f77-b180-a009aa05637e","name":"Microsoft.Workflow.Compiler.exe Payload Execution","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Emulates attack with Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe\n","inputs":{"xml_payload":{"description":"XML to execution","type":"path","default":"PathToAtomicsFolder\\T1218\\src\\T1218.xml"},"mwcpath":{"description":"Default location of Microsoft.Workflow.Compiler.exe","type":"path","default":"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319"},"mwcname":{"description":"Default name of microsoft.workflow.compiler.exe","type":"path","default":"microsoft.workflow.compiler.exe"}},"dependencies":[{"description":".Net must be installed for this test to work correctly.\n"}],"source_definition_sha256":"cab04f007b6b34ad9796b24d0cc7e041dfa010f923f6602d12cd30db7db2992e"},{"id":"9ebe7901-7edf-45c0-b5c7-8366300919db","name":"Invoke-ATHRemoteFXvGPUDisablementCommand base test","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).\n\nOne of the PowerShell functions called by RemoteFXvGPUDisablement.exe is Get-VMRemoteFXPhysicalVideoAdapter, a part of the Hyper-V module. This atomic test influences RemoteFXvGPUDisablement.exe to execute custom PowerShell code by using a technique referred to as \"PowerShell module load-order hijacking\" where a module containing, in this case, an implementation of the Get-VMRemoteFXPhysicalVideoAdapter is loaded first by way of introducing a temporary module into the first directory listed in the %PSModulePath% environment variable or within a user-specified module directory outside of %PSModulePath%. Upon execution the temporary module is deleted.\n\nInvoke-ATHRemoteFXvGPUDisablementCommand is used in this test to demonstrate how a PowerShell host executable can be directed to user-supplied PowerShell code without needing to supply anything at the command-line. PowerShell code execution is triggered when supplying the \"Disable\" argument to RemoteFXvGPUDisablement.exe.\n\nThe Invoke-ATHRemoteFXvGPUDisablementCommand function outputs all relevant execution-related artifacts.\n\nReference: https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1\n","inputs":{"module_name":{"description":"Specifies a temporary module name to use. If -ModuleName is not supplied, a 16-character random temporary module name is used. A PowerShell module can have any name. Because Get-VMRemoteFXPhysicalVideoAdapter abuses module load order, a module name must be specified.","type":"string","default":"foo"},"module_path":{"description":"Specifies an alternate, non-default PowerShell module path for RemoteFXvGPUDisablement.exe. If -ModulePath is not specified, the first entry in %PSModulePath% will be used. Typically, this is %USERPROFILE%\\Documents\\WindowsPowerShell\\Modules.","type":"string","default":"$PWD"}},"dependencies":[{"description":"The AtomicTestHarnesses module must be installed and Invoke-ATHRemoteFXvGPUDisablementCommand must be exported in the module."}],"source_definition_sha256":"f3a16dfcc266d7d58b2384a1d35a4f65dbec3dcc2a3978d989528882761959a3"},{"id":"ab76e34f-28bf-441f-a39c-8db4835b89cc","name":"Provlaunch.exe Executes Arbitrary Command via Registry Key","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Provlaunch.exe executes a command defined in the Registry. This test will create the necessary registry keys and values, then run provlaunch.exe to execute an arbitrary command.\n- https://twitter.com/0gtweet/status/1674399582162153472\n- https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/\nRegistry keys are deleted after successful execution.\n","inputs":{},"dependencies":[],"source_definition_sha256":"e638a8fda4218cf7f9edb669aeec983e78e39a91d1ebe57a542a783ba14a6c8f"},{"id":"ad2c17ed-f626-4061-b21e-b9804a6f3655","name":"Register-CimProvider - Execute evil dll","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Execute arbitrary dll. Requires at least Windows 8/2012. Also note this dll can be served up via SMB\n","inputs":{"dll_payload":{"description":"DLL to execute","type":"path","default":"PathToAtomicsFolder\\T1218\\src\\Win32\\T1218-2.dll"}},"dependencies":[{"description":"T1218-2.dll must exist on disk at specified location (#{dll_payload})\n"}],"source_definition_sha256":"5ad4c9d0731670edb2c678879d319dea13284616e73532b5c6e35dcbe746c53a"},{"id":"b1eeb683-90bb-4365-bbc2-2689015782fe","name":"LOLBAS CustomShellHost to Spawn Process","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"This test simulates an adversary copying `customshellhost.exe` and `calc.exe` from `C:\\windows\\system32\\` to `C:\\temp\\`, renaming `calc.exe` to `explorer.exe`.\nUpon execution, customshellhost.exe will spawn calc.exe.\nNote this will only work on Windows 10 or 11.\n[LOLBAS](https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/)\n[BishopFox](https://bishopfox.com/blog/edr-bypass-with-lolbins)\n","inputs":{"dest_path":{"description":"Directory to copy files into","type":"path","default":"C:\\test"}},"dependencies":[],"source_definition_sha256":"dd5dc4f7ecad25eb7f0873c7ab5acead62d9839c40e348cce07f1e25a56a57b4"},{"id":"c426dacf-575d-4937-8611-a148a86a5e61","name":"mavinject - Inject DLL into running process","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Injects arbitrary DLL into running process specified by process ID. Requires Windows 10.\n","inputs":{"process_id":{"description":"PID of process receiving injection","type":"string","default":"1000"},"dll_payload":{"description":"DLL to inject","type":"path","default":"PathToAtomicsFolder\\T1218\\src\\x64\\T1218.dll"}},"dependencies":[{"description":"T1218.dll must exist on disk at specified location (#{dll_payload})\n"}],"source_definition_sha256":"1010ac7683cb4f6dc2b3442bd34e7a313aaf5223e60939935001e680f9bddbe4"},{"id":"db020456-125b-4c8b-a4a7-487df8afb5a2","name":"ProtocolHandler.exe Downloaded a Suspicious File","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Emulates attack via documents through protocol handler in Microsoft Office.  On successful execution you should see Microsoft Word launch a blank file.\n","inputs":{"remote_url":{"description":"url to document","type":"url","default":"https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218/src/T1218Test.docx"}},"dependencies":[{"description":"Microsoft Word must be installed\n"}],"source_definition_sha256":"d3fc09f74128bbd9beb6af3567acaa492254372da59623a75195fe6cbf9f8cc1"},{"id":"e5eedaed-ad42-4c1e-8783-19529738a349","name":"LOLBAS Msedge to Spawn Process","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Executes a process under a trusted Microsoft signed binary,mseddge. This test will spawn \"calc.exe\" as a child process of msedge.exe\n- https://lolbas-project.github.io/lolbas/Binaries/Msedge/\n","inputs":{},"dependencies":[],"source_definition_sha256":"de7f0da18dd074a70f7b1fad6c04287227aefa7232e6e949e10f0a9078154441"},{"id":"f8da74bb-21b8-4af9-8d84-f2c8e4a220e3","name":"Lolbin Gpscript startup option","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1218/T1218.yaml","description":"Executes startup scripts configured in Group Policy\nhttps://lolbas-project.github.io/lolbas/Binaries/Gpscript/\nhttps://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/\n","inputs":{},"dependencies":[],"source_definition_sha256":"a25409a7c2209d4fe258d4fdd4bd5038de9b4cbc35c0e72e3fb821d743439c1b"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1218":"/ttp-simulation/techniques/enterprise/T1218/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1218","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}