1200KM / detection
T0894 System Binary Proxy Execution — Detection Rules
Detection workspace for T0894 System Binary Proxy Execution: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0793 Detection of System Binary Proxy Execution
AN1925 Analytic 1925
Real-time monitoring identifies a trusted, signed Windows system binary executing with command-line arguments inconsistent with its documented administrative purpose -- specifically arguments indicating payload decoding, remote content execution, or script invocation -- on an Industrial Control System (ICS) host. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
AN2152 Analytic 2152
Real-time monitoring identifies system binaries (bash, python, perl, awk, dd) on Industrial Control System (ICS) Linux assets executing with arguments that pipe or decode external content rather than performing their documented administrative function. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
AN2242 Analytic 2242
Real-time monitoring identifies Industrial Control System (ICS) protocol messages using embedded device built-in utilities or vendor-supplied diagnostic tools to execute payloads, from sources not in the approved engineering workstation list, containing payloads inconsistent with legitimate diagnostic use. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.