T1216 System Script Proxy Execution — Detection Rules

Source-backed rule directory

• AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File · test · medium · {"product":"windows","category":"file_event"}
• Suspicious CustomShellHost Execution · test · high · {"category":"process_creation","product":"windows"}
• Potential Manage-bde.wsf Abuse To Proxy Execution · test · high · {"category":"process_creation","product":"windows"}
• Execute Code with Pester.bat as Parent · test · medium · {"category":"process_creation","product":"windows"}
• Execute Code with Pester.bat · test · medium · {"category":"process_creation","product":"windows"}
• SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code · test · medium · {"category":"process_creation","product":"windows"}
• UtilityFunctions.ps1 Proxy Dll · test · medium · {"category":"process_creation","product":"windows"}
• Potential Process Execution Proxy Via CL_Invocation.ps1 · test · medium · {"category":"process_creation","product":"windows"}
• Assembly Loading Via CL_LoadAssembly.ps1 · test · medium · {"category":"process_creation","product":"windows"}
• Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 · test · medium · {"category":"process_creation","product":"windows"}
• Uncommon Sigverif.EXE Child Process · test · medium · {"category":"process_creation","product":"windows"}
• AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl · test · medium · {"category":"process_creation","product":"windows"}
• Remote Code Execute via Winrm.vbs · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0466 Detection of Script-Based Proxy Execution via Signed Microsoft Utilities

AN1288 Analytic 1288

Execution of Microsoft-signed scripts (e.g., pubprn.vbs, installutil.exe, wscript.exe, cscript.exe) used to proxy execution of untrusted or external binaries. Behavior is detected through command-line process lineage, child process spawning, and unsigned payload execution from signed parent.