T1218 System Binary Proxy Execution — Detection Rules

Detection workspace for T1218 System Binary Proxy Execution: 135 Sigma sources, 2 Atlas concepts and 1 anomaly models. No live detection validation.

Source-backed rule directory

Hidden Flag Set On File/Directory Via Chflags - MacOS · test · medium · {"product":"macos","category":"process_creation"}
MSI Installation From Web · test · medium · {"product":"windows","service":"application"}
Suspicious DotNET CLR Usage Log Artifact · test · high · {"category":"file_event","product":"windows","definition":"Requirements: UsageLogs folder must be monitored by the sysmon configuration"}
Self Extraction Directive File Created In Potentially Suspicious Location · test · medium · {"category":"file_event","product":"windows"}
Created Files by Microsoft Sync Center · test · medium · {"product":"windows","category":"file_event"}
Legitimate Application Dropped Archive · test · high · {"product":"windows","category":"file_event"}
Legitimate Application Dropped Executable · test · high · {"product":"windows","category":"file_event"}
Legitimate Application Writing Files In Uncommon Location · experimental · high · {"product":"windows","category":"file_event"}
Legitimate Application Dropped Script · test · high · {"product":"windows","category":"file_event"}
Potentially Suspicious Self Extraction Directive File Created · test · medium · {"product":"windows","category":"file_executable_detected"}
Time Travel Debugging Utility Usage - Image · test · high · {"product":"windows","category":"image_load"}
Potential DLL Sideloading Using Coregen.exe · test · medium · {"category":"image_load","product":"windows"}
BaaUpdate.exe Suspicious DLL Load · experimental · high · {"category":"image_load","product":"windows"}
Network Connection Initiated By AddinUtil.EXE · test · high · {"category":"network_connection","product":"windows"}
Microsoft Sync Center Suspicious Network Connections · test · medium · {"product":"windows","category":"network_connection"}
Potentially Suspicious Wuauclt Network Connection · test · medium · {"category":"network_connection","product":"windows","definition":"Requirements: The CommandLine field enrichment is required in order for this rule to be used."}
Potential RemoteFXvGPUDisablement.EXE Abuse · test · high · {"product":"windows","service":"powershell-classic","definition":"fields have to be extract from event"}
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module · test · high · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
SyncAppvPublishingServer Bypass Powershell Restriction - PS Module · test · medium · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock · test · high · {"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"}
SyncAppvPublishingServer Execution to Bypass Powershell Restriction · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Suspicious AddinUtil.EXE CommandLine Execution · test · high · {"category":"process_creation","product":"windows"}
Uncommon Child Process Of AddinUtil.EXE · test · medium · {"category":"process_creation","product":"windows"}
Uncommon AddinUtil.EXE CommandLine Execution · test · medium · {"category":"process_creation","product":"windows"}
AddinUtil.EXE Execution From Uncommon Directory · test · medium · {"category":"process_creation","product":"windows"}
AgentExecutor PowerShell Execution · test · medium · {"category":"process_creation","product":"windows"}
Suspicious AgentExecutor PowerShell Execution · test · high · {"category":"process_creation","product":"windows"}
Uncommon Child Process Of Appvlp.EXE · test · medium · {"category":"process_creation","product":"windows"}
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE · test · medium · {"category":"process_creation","product":"windows"}
Suspicious BitLocker Access Agent Update Utility Execution · experimental · high · {"category":"process_creation","product":"windows"}
Suspicious Child Process Of BgInfo.EXE · test · high · {"category":"process_creation","product":"windows"}
Uncommon Child Process Of BgInfo.EXE · test · medium · {"category":"process_creation","product":"windows"}
BitLockerTogo.EXE Execution · test · low · {"category":"process_creation","product":"windows"}
Potential Binary Proxy Execution Via Cdb.EXE · test · medium · {"category":"process_creation","product":"windows"}
DLL Loaded via CertOC.EXE · test · medium · {"category":"process_creation","product":"windows"}
Suspicious DLL Loaded via CertOC.EXE · test · high · {"category":"process_creation","product":"windows"}
Potential NTLM Coercion Via Certutil.EXE · test · high · {"category":"process_creation","product":"windows"}
Curl Download And Execute Combination · test · high · {"category":"process_creation","product":"windows"}
Potentially Suspicious CMD Shell Output Redirect · test · medium · {"category":"process_creation","product":"windows"}
Potential Arbitrary File Download Via Cmdl32.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potentially Suspicious Child Processes Spawned by ConHost · experimental · high · {"category":"process_creation","product":"windows"}
Suspicious Csi.exe Usage · test · medium · {"category":"process_creation","product":"windows"}
Uncommon Child Process Of Defaultpack.EXE · test · medium · {"category":"process_creation","product":"windows"}
DeviceCredentialDeployment Execution · test · medium · {"category":"process_creation","product":"windows"}
Arbitrary MSI Download Via Devinit.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potentially Suspicious Child Process Of DiskShadow.EXE · test · medium · {"category":"process_creation","product":"windows"}
Diskshadow Script Mode - Uncommon Script Extension Execution · test · medium · {"category":"process_creation","product":"windows"}
Diskshadow Script Mode - Execution From Potential Suspicious Location · test · medium · {"category":"process_creation","product":"windows"}
Potential Application Whitelisting Bypass via Dnx.EXE · test · medium · {"category":"process_creation","product":"windows"}
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE · test · medium · {"category":"process_creation","product":"windows"}
Binary Proxy Execution Via Dotnet-Trace.EXE · test · medium · {"category":"process_creation","product":"windows"}
Process Memory Dump Via Dotnet-Dump · test · medium · {"category":"process_creation","product":"windows"}
Potentially Over Permissive Permissions Granted Using Dsacls.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potential Password Spraying Attempt Using Dsacls.EXE · test · medium · {"category":"process_creation","product":"windows"}
New Capture Session Launched Via DXCap.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potentially Suspicious Cabinet File Expansion · test · medium · {"category":"process_creation","product":"windows"}
Remote File Download Via Findstr.EXE · test · medium · {"category":"process_creation","product":"windows"}
Insensitive Subfolder Search Via Findstr.EXE · test · low · {"category":"process_creation","product":"windows"}
HTML Help HH.EXE Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
Suspicious HH.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
Suspicious ZipExec Execution · test · medium · {"category":"process_creation","product":"windows"}
Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location · test · high · {"category":"process_creation","product":"windows"}
Arbitrary File Download Via IMEWDBLD.EXE · test · high · {"category":"process_creation","product":"windows"}
InfDefaultInstall.exe .inf Execution · test · medium · {"category":"process_creation","product":"windows"}
File Download Via InstallUtil.EXE · test · medium · {"category":"process_creation","product":"windows"}
Import LDAP Data Interchange Format File Via Ldifde.EXE · test · medium · {"category":"process_creation","product":"windows"}
Uncommon Link.EXE Parent Process · test · medium · {"category":"process_creation","product":"windows"}
Devtoolslauncher.exe Executes Specified Binary · test · high · {"category":"process_creation","product":"windows"}
Gpscript Execution · test · medium · {"product":"windows","category":"process_creation"}
Ie4uinit Lolbin Use From Invalid Path · test · medium · {"product":"windows","category":"process_creation"}
MpiExec Lolbin · test · high · {"category":"process_creation","product":"windows"}
Execute Files with Msdeploy.exe · test · medium · {"category":"process_creation","product":"windows"}
OpenWith.exe Executes Specified Binary · test · high · {"category":"process_creation","product":"windows"}
Indirect Command Execution By Program Compatibility Wizard · test · low · {"category":"process_creation","product":"windows"}
Execute Pcwrun.EXE To Leverage Follina · test · high · {"category":"process_creation","product":"windows"}
DLL Execution via Rasautou.exe · test · medium · {"product":"windows","category":"process_creation","definition":"Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud)"}
REGISTER_APP.VBS Proxy Execution · test · medium · {"category":"process_creation","product":"windows"}
Lolbin Runexehelper Use As Proxy · test · medium · {"category":"process_creation","product":"windows"}
Use of Scriptrunner.exe · test · medium · {"category":"process_creation","product":"windows"}
Use Of The SFTP.EXE Binary As A LOLBIN · test · medium · {"category":"process_creation","product":"windows"}
SyncAppvPublishingServer Execute Arbitrary PowerShell Code · test · medium · {"category":"process_creation","product":"windows"}
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code · test · medium · {"category":"process_creation","product":"windows"}
Time Travel Debugging Utility Usage · test · high · {"product":"windows","category":"process_creation"}
Lolbin Unregmp2.exe Use As Proxy · test · medium · {"category":"process_creation","product":"windows"}
Use of VisualUiaVerifyNative.exe · test · medium · {"category":"process_creation","product":"windows"}
Potential Register_App.Vbs LOLScript Abuse · test · medium · {"category":"process_creation","product":"windows"}
Potential Suspicious Mofcomp Execution · test · high · {"category":"process_creation","product":"windows"}
File Download Via Windows Defender MpCmpRun.EXE · test · high · {"category":"process_creation","product":"windows"}
MSDT Execution Via Answer File · test · high · {"category":"process_creation","product":"windows"}
Suspicious MSDT Parent Process · test · high · {"category":"process_creation","product":"windows"}
Arbitrary File Download Via MSEDGE_PROXY.EXE · test · medium · {"category":"process_creation","product":"windows"}
Windows MSIX Package Support Framework AI_STUBS Execution · experimental · low · {"category":"process_creation","product":"windows"}
Arbitrary File Download Via MSOHTMED.EXE · test · medium · {"category":"process_creation","product":"windows"}
Arbitrary File Download Via MSPUB.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution · test · medium · {"category":"process_creation","product":"windows"}
PowerShell MSI Install via WindowsInstaller COM From Remote Location · experimental · medium · {"category":"process_creation","product":"windows"}
RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses · test · high · {"product":"windows","category":"process_creation"}
Arbitrary File Download Via PresentationHost.EXE · test · medium · {"category":"process_creation","product":"windows"}
XBAP Execution From Uncommon Locations Via PresentationHost.EXE · test · medium · {"category":"process_creation","product":"windows"}
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution · test · medium · {"category":"process_creation","product":"windows"}
Sensitive File Dump Via Print.EXE · test · high · {"category":"process_creation","product":"windows"}
Abusing Print Executable · test · medium · {"category":"process_creation","product":"windows"}
File Download Using ProtocolHandler.exe · test · medium · {"category":"process_creation","product":"windows"}
Potential Provlaunch.EXE Binary Proxy Execution Abuse · test · medium · {"category":"process_creation","product":"windows"}
Suspicious Provlaunch.EXE Child Process · test · high · {"category":"process_creation","product":"windows"}
Potential Provisioning Registry Key Abuse For Binary Proxy Execution · test · high · {"category":"process_creation","product":"windows"}
Renamed ZOHO Dctask64 Execution · test · high · {"category":"process_creation","product":"windows"}
Renamed MegaSync Execution · test · high · {"product":"windows","category":"process_creation"}
Visual Studio NodejsTools PressAnyKey Renamed Execution · test · medium · {"category":"process_creation","product":"windows"}
Scheduled Task Creation with Curl and PowerShell Execution Combo · experimental · medium · {"category":"process_creation","product":"windows"}
Sdiagnhost Calling Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
Uncommon Child Process Of Setres.EXE · test · high · {"category":"process_creation","product":"windows"}
Suspicious Speech Runtime Binary Child Process · experimental · high · {"category":"process_creation","product":"windows"}
Arbitrary File Download Via Squirrel.EXE · test · medium · {"category":"process_creation","product":"windows"}
Process Proxy Execution Via Squirrel.EXE · test · medium · {"category":"process_creation","product":"windows"}
Program Executed Using Proxy/Local Command Via SSH.EXE · test · medium · {"category":"process_creation","product":"windows"}
Execution via stordiag.exe · test · high · {"category":"process_creation","product":"windows"}
Potential File Download Via MS-AppInstaller Protocol Handler · test · medium · {"category":"process_creation","product":"windows"}
Windows Shell/Scripting Processes Spawning Suspicious Programs · test · high · {"category":"process_creation","product":"windows"}
Malicious Windows Script Components File Execution by TAEF Detection · test · low · {"category":"process_creation","product":"windows"}
Malicious PE Execution by Microsoft Visual Studio Debugger · test · medium · {"category":"process_creation","product":"windows"}
Execution via WorkFolders.exe · test · high · {"category":"process_creation","product":"windows"}
Potential Binary Impersonating Sysinternals Tools · test · medium · {"category":"process_creation","product":"windows"}
Verclsid.exe Runs COM Object · test · medium · {"category":"process_creation","product":"windows"}
Potentially Suspicious Child Process Of VsCode · test · medium · {"category":"process_creation","product":"windows"}
Potential Binary Proxy Execution Via VSDiagnostics.EXE · test · medium · {"category":"process_creation","product":"windows"}
Suspicious Vsls-Agent Command With AgentExtensionPath Load · test · medium · {"category":"process_creation","product":"windows"}
Winrs Local Command Execution · experimental · high · {"category":"process_creation","product":"windows"}
Wlrmdr.EXE Uncommon Argument Or Child Process · experimental · medium · {"category":"process_creation","product":"windows"}
WSL Child Process Anomaly · test · medium · {"category":"process_creation","product":"windows"}
Proxy Execution Via Wuauclt.EXE · test · high · {"category":"process_creation","product":"windows"}
COM Object Execution via Xwizard.EXE · test · medium · {"category":"process_creation","product":"windows"}
Atbroker Registry Change · test · medium · {"category":"registry_event","product":"windows"}
Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG · test · high · {"category":"registry_set","product":"windows","definition":"Requirements: The registry key \"\\SOFTWARE\\Microsoft\\Provisioning\\Commands\\\" and its subkey must be monitored"}
Execution DLL of Choice Using WAB.EXE · test · high · {"category":"registry_set","product":"windows"}

Atlas deterministic concepts

T1218 System Binary Proxy Execution

MATCH(process_name IN proxy_execution_binaries) AND command_line MATCHES known_abuse_patterns -> ALERT

T1218 System Binary Proxy Execution

MATCH(proxy_execution_binary) AND command_line MATCHES known_abuse_signature -> ALERT

Anomaly models

Trusted system binary launches unexpected content — T1218 System Binary Proxy Execution

Comparison unit: parent-child process relationship and command context.

Expected behavior: trusted binaries execute a limited set of recurring children or resources.

Deviation: an otherwise common binary forms a rare edge or conditional combination.

ATT&CK analytic guidance

DET0081 Detection of Proxy Execution via Trusted Signed Binaries Across Platforms

AN0226 Analytic 0226

Execution of trusted, Microsoft-signed binaries such as `rundll32.exe`, `msiexec.exe`, or `regsvr32.exe` used to execute externally hosted, unsigned, or suspicious payloads through command-line parameters or network retrieval.

AN0227 Analytic 0227

Execution of trusted system binaries (e.g., `split`, `tee`, `bash`, `env`) used in uncommon sequences or chained behaviors to execute malicious payloads or perform actions inconsistent with normal system or script behavior.

AN0228 Analytic 0228

Use of system binaries such as `osascript`, `bash`, or `curl` to download or execute unsigned code or files in conjunction with application proxying.

Connected ecosystem references

Linked tags

rule_source_available Category-Combination Anomaly Conditional Anomaly Edge Anomaly

Simulation, tools and telemetry

T1218 simulation workspace

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Connected anomaly research

Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.

Parent-Child Execution

Telemetry contracts · Maintained query examples · Validation and blind spots

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.