1200KM / detection
T0894 System Binary Proxy Execution — Detection Rules
Detection workspace for T0894 System Binary Proxy Execution: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0793 Detection of System Binary Proxy Execution
AN1925 Analytic 1925
Monitor for any suspicious attempts to enable script execution on a system. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Monitor executed commands and associated arguments for application programs which support executing custom code, scripts, commands, or executables. Monitor for unusual processes execution, especially for processes that allow the proxy execution of malicious files.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.