T1218 System Binary Proxy Execution — Attack Simulation

DC0016 collection page — Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, image_loaded, signed, action.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0016",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "image_loaded": "C:\\Lab\\demo.dll",
    "signed": false,
    "action": "load"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

MITRE detection strategy

135 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Hidden Flag Set On File/Directory Via Chflags - MacOS — test; product: macos; category: process_creation.
• MSI Installation From Web — test; product: windows; service: application.
• Suspicious DotNET CLR Usage Log Artifact — test; category: file_event; product: windows; definition: Requirements: UsageLogs folder must be monitored by the sysmon configuration.
• Self Extraction Directive File Created In Potentially Suspicious Location — test; category: file_event; product: windows.
• Created Files by Microsoft Sync Center — test; product: windows; category: file_event.
• Legitimate Application Dropped Archive — test; product: windows; category: file_event.
• Legitimate Application Dropped Executable — test; product: windows; category: file_event.
• Legitimate Application Writing Files In Uncommon Location — experimental; product: windows; category: file_event.
• Legitimate Application Dropped Script — test; product: windows; category: file_event.
• Potentially Suspicious Self Extraction Directive File Created — test; product: windows; category: file_executable_detected.
• Time Travel Debugging Utility Usage - Image — test; product: windows; category: image_load.
• Potential DLL Sideloading Using Coregen.exe — test; category: image_load; product: windows.
• BaaUpdate.exe Suspicious DLL Load — experimental; category: image_load; product: windows.
• Network Connection Initiated By AddinUtil.EXE — test; category: network_connection; product: windows.
• Microsoft Sync Center Suspicious Network Connections — test; product: windows; category: network_connection.
• Potentially Suspicious Wuauclt Network Connection — test; category: network_connection; product: windows; definition: Requirements: The CommandLine field enrichment is required in order for this rule to be used..
• Potential RemoteFXvGPUDisablement.EXE Abuse — test; product: windows; service: powershell-classic; definition: fields have to be extract from event.
• Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module — test; product: windows; category: ps_module; definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b.
• SyncAppvPublishingServer Bypass Powershell Restriction - PS Module — test; product: windows; category: ps_module; definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b.
• Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock — test; product: windows; category: ps_script; definition: bade5735-5ab0-4aa7-a642-a11be0e40872.
• SyncAppvPublishingServer Execution to Bypass Powershell Restriction — test; product: windows; category: ps_script; definition: Requirements: Script Block Logging must be enabled.
• Suspicious AddinUtil.EXE CommandLine Execution — test; category: process_creation; product: windows.
• Uncommon Child Process Of AddinUtil.EXE — test; category: process_creation; product: windows.
• Uncommon AddinUtil.EXE CommandLine Execution — test; category: process_creation; product: windows.
• AddinUtil.EXE Execution From Uncommon Directory — test; category: process_creation; product: windows.
• AgentExecutor PowerShell Execution — test; category: process_creation; product: windows.
• Suspicious AgentExecutor PowerShell Execution — test; category: process_creation; product: windows.
• Uncommon Child Process Of Appvlp.EXE — test; category: process_creation; product: windows.
• Uncommon Assistive Technology Applications Execution Via AtBroker.EXE — test; category: process_creation; product: windows.
• Suspicious BitLocker Access Agent Update Utility Execution — experimental; category: process_creation; product: windows.
• Suspicious Child Process Of BgInfo.EXE — test; category: process_creation; product: windows.
• Uncommon Child Process Of BgInfo.EXE — test; category: process_creation; product: windows.
• BitLockerTogo.EXE Execution — test; category: process_creation; product: windows.
• Potential Binary Proxy Execution Via Cdb.EXE — test; category: process_creation; product: windows.
• DLL Loaded via CertOC.EXE — test; category: process_creation; product: windows.
• Suspicious DLL Loaded via CertOC.EXE — test; category: process_creation; product: windows.
• Potential NTLM Coercion Via Certutil.EXE — test; category: process_creation; product: windows.
• Curl Download And Execute Combination — test; category: process_creation; product: windows.
• Potentially Suspicious CMD Shell Output Redirect — test; category: process_creation; product: windows.
• Potential Arbitrary File Download Via Cmdl32.EXE — test; category: process_creation; product: windows.
• Potentially Suspicious Child Processes Spawned by ConHost — experimental; category: process_creation; product: windows.
• Suspicious Csi.exe Usage — test; category: process_creation; product: windows.
• Uncommon Child Process Of Defaultpack.EXE — test; category: process_creation; product: windows.
• DeviceCredentialDeployment Execution — test; category: process_creation; product: windows.
• Arbitrary MSI Download Via Devinit.EXE — test; category: process_creation; product: windows.
• Potentially Suspicious Child Process Of DiskShadow.EXE — test; category: process_creation; product: windows.
• Diskshadow Script Mode - Uncommon Script Extension Execution — test; category: process_creation; product: windows.
• Diskshadow Script Mode - Execution From Potential Suspicious Location — test; category: process_creation; product: windows.
• Potential Application Whitelisting Bypass via Dnx.EXE — test; category: process_creation; product: windows.
• Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE — test; category: process_creation; product: windows.
• Binary Proxy Execution Via Dotnet-Trace.EXE — test; category: process_creation; product: windows.
• Process Memory Dump Via Dotnet-Dump — test; category: process_creation; product: windows.
• Potentially Over Permissive Permissions Granted Using Dsacls.EXE — test; category: process_creation; product: windows.
• Potential Password Spraying Attempt Using Dsacls.EXE — test; category: process_creation; product: windows.
• New Capture Session Launched Via DXCap.EXE — test; category: process_creation; product: windows.
• Potentially Suspicious Cabinet File Expansion — test; category: process_creation; product: windows.
• Remote File Download Via Findstr.EXE — test; category: process_creation; product: windows.
• Insensitive Subfolder Search Via Findstr.EXE — test; category: process_creation; product: windows.
• HTML Help HH.EXE Suspicious Child Process — test; category: process_creation; product: windows.
• Suspicious HH.EXE Execution — test; category: process_creation; product: windows.
• Suspicious ZipExec Execution — test; category: process_creation; product: windows.
• Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location — test; category: process_creation; product: windows.
• Arbitrary File Download Via IMEWDBLD.EXE — test; category: process_creation; product: windows.
• InfDefaultInstall.exe .inf Execution — test; category: process_creation; product: windows.
• File Download Via InstallUtil.EXE — test; category: process_creation; product: windows.
• Import LDAP Data Interchange Format File Via Ldifde.EXE — test; category: process_creation; product: windows.
• Uncommon Link.EXE Parent Process — test; category: process_creation; product: windows.
• Devtoolslauncher.exe Executes Specified Binary — test; category: process_creation; product: windows.
• Gpscript Execution — test; product: windows; category: process_creation.
• Ie4uinit Lolbin Use From Invalid Path — test; product: windows; category: process_creation.
• MpiExec Lolbin — test; category: process_creation; product: windows.
• Execute Files with Msdeploy.exe — test; category: process_creation; product: windows.
• OpenWith.exe Executes Specified Binary — test; category: process_creation; product: windows.
• Indirect Command Execution By Program Compatibility Wizard — test; category: process_creation; product: windows.
• Execute Pcwrun.EXE To Leverage Follina — test; category: process_creation; product: windows.
• DLL Execution via Rasautou.exe — test; product: windows; category: process_creation; definition: Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud).
• REGISTER_APP.VBS Proxy Execution — test; category: process_creation; product: windows.
• Lolbin Runexehelper Use As Proxy — test; category: process_creation; product: windows.
• Use of Scriptrunner.exe — test; category: process_creation; product: windows.
• Use Of The SFTP.EXE Binary As A LOLBIN — test; category: process_creation; product: windows.
• SyncAppvPublishingServer Execute Arbitrary PowerShell Code — test; category: process_creation; product: windows.
• SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code — test; category: process_creation; product: windows.
• Time Travel Debugging Utility Usage — test; product: windows; category: process_creation.
• Lolbin Unregmp2.exe Use As Proxy — test; category: process_creation; product: windows.
• Use of VisualUiaVerifyNative.exe — test; category: process_creation; product: windows.
• Potential Register_App.Vbs LOLScript Abuse — test; category: process_creation; product: windows.
• Potential Suspicious Mofcomp Execution — test; category: process_creation; product: windows.
• File Download Via Windows Defender MpCmpRun.EXE — test; category: process_creation; product: windows.
• MSDT Execution Via Answer File — test; category: process_creation; product: windows.
• Suspicious MSDT Parent Process — test; category: process_creation; product: windows.
• Arbitrary File Download Via MSEDGE_PROXY.EXE — test; category: process_creation; product: windows.
• Windows MSIX Package Support Framework AI_STUBS Execution — experimental; category: process_creation; product: windows.
• Arbitrary File Download Via MSOHTMED.EXE — test; category: process_creation; product: windows.
• Arbitrary File Download Via MSPUB.EXE — test; category: process_creation; product: windows.
• Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution — test; category: process_creation; product: windows.
• PowerShell MSI Install via WindowsInstaller COM From Remote Location — experimental; category: process_creation; product: windows.
• RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses — test; product: windows; category: process_creation.
• Arbitrary File Download Via PresentationHost.EXE — test; category: process_creation; product: windows.
• XBAP Execution From Uncommon Locations Via PresentationHost.EXE — test; category: process_creation; product: windows.
• Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution — test; category: process_creation; product: windows.
• Sensitive File Dump Via Print.EXE — test; category: process_creation; product: windows.
• Abusing Print Executable — test; category: process_creation; product: windows.
• File Download Using ProtocolHandler.exe — test; category: process_creation; product: windows.
• Potential Provlaunch.EXE Binary Proxy Execution Abuse — test; category: process_creation; product: windows.
• Suspicious Provlaunch.EXE Child Process — test; category: process_creation; product: windows.
• Potential Provisioning Registry Key Abuse For Binary Proxy Execution — test; category: process_creation; product: windows.
• Renamed ZOHO Dctask64 Execution — test; category: process_creation; product: windows.
• Renamed MegaSync Execution — test; product: windows; category: process_creation.
• Visual Studio NodejsTools PressAnyKey Renamed Execution — test; category: process_creation; product: windows.
• Scheduled Task Creation with Curl and PowerShell Execution Combo — experimental; category: process_creation; product: windows.
• Sdiagnhost Calling Suspicious Child Process — test; category: process_creation; product: windows.
• Uncommon Child Process Of Setres.EXE — test; category: process_creation; product: windows.
• Suspicious Speech Runtime Binary Child Process — experimental; category: process_creation; product: windows.
• Arbitrary File Download Via Squirrel.EXE — test; category: process_creation; product: windows.
• Process Proxy Execution Via Squirrel.EXE — test; category: process_creation; product: windows.
• Program Executed Using Proxy/Local Command Via SSH.EXE — test; category: process_creation; product: windows.
• Execution via stordiag.exe — test; category: process_creation; product: windows.
• Potential File Download Via MS-AppInstaller Protocol Handler — test; category: process_creation; product: windows.
• Windows Shell/Scripting Processes Spawning Suspicious Programs — test; category: process_creation; product: windows.
• Malicious Windows Script Components File Execution by TAEF Detection — test; category: process_creation; product: windows.
• Malicious PE Execution by Microsoft Visual Studio Debugger — test; category: process_creation; product: windows.
• Execution via WorkFolders.exe — test; category: process_creation; product: windows.
• Potential Binary Impersonating Sysinternals Tools — test; category: process_creation; product: windows.
• Verclsid.exe Runs COM Object — test; category: process_creation; product: windows.
• Potentially Suspicious Child Process Of VsCode — test; category: process_creation; product: windows.
• Potential Binary Proxy Execution Via VSDiagnostics.EXE — test; category: process_creation; product: windows.
• Suspicious Vsls-Agent Command With AgentExtensionPath Load — test; category: process_creation; product: windows.
• Winrs Local Command Execution — experimental; category: process_creation; product: windows.
• Wlrmdr.EXE Uncommon Argument Or Child Process — experimental; category: process_creation; product: windows.
• WSL Child Process Anomaly — test; category: process_creation; product: windows.
• Proxy Execution Via Wuauclt.EXE — test; category: process_creation; product: windows.
• COM Object Execution via Xwizard.EXE — test; category: process_creation; product: windows.
• Atbroker Registry Change — test; category: registry_event; product: windows.
• Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG — test; category: registry_set; product: windows; definition: Requirements: The registry key "\SOFTWARE\Microsoft\Provisioning\Commands\" and its subkey must be monitored.
• Execution DLL of Choice Using WAB.EXE — test; category: registry_set; product: windows.

Emulates attack with a DiskShadow.exe (LOLBIN installed by default on Windows) being used to execute arbitrary commands Reference: https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/

Pinned Atomic procedure · 0e1483ba-8f0c-425d-b8c6-42736e058eaa · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• txt_payload: txt to execute (type path; source default PathToAtomicsFolder\T1218\src\T1218.txt)
• dspath: Default location of DiskShadow.exe (type path; source default C:\Windows\System32\diskshadow.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

2 prerequisite definitions:

• txt file must exist on disk at specified location (#{txt_payload})
• DiskShadow.exe must exist on disk at specified location (#{dspath})

Executes commands from a specially prepared ie4uinit.inf file.
Poc from : https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
Reference: https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/

Pinned Atomic procedure · 13c0804e-615e-43ad-b223-2dfbacd0b0b3 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• Path_inf: Path to the cab file (type path; source default PathToAtomicsFolder\T1218\src\ieuinit.inf)
• Path_ie4uinit: Path to ie4uinit.exe (type path; source default c:\windows\system32\ie4uinit.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• ieuinit.inf must exist on disk at specified location (#{Path_inf})

This test uses Wuauclt to load an arbitrary DLL. Upon execution with the default inputs, calculator.exe will be launched.
See https://dtm.uk/wuauclt/

Pinned Atomic procedure · 49fbd548-49e9-4bb7-94a6-3769613912b8 · windows · command_prompt.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• arbitrary_dll: Path of DLL to be loaded (type string; source default PathToAtomicsFolder\T1218\bin\calc.dll)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• DLL to load must exist on disk as specified location (#{arbitrary_dll})

Emulates attack with a renamed Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe

Pinned Atomic procedure · 4cc40fd7-87b8-4b16-b2d7-57534b86b911 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• xml_payload: XML to execution (type path; source default PathToAtomicsFolder\T1218\src\T1218.xml)
• renamed_binary: renamed Microsoft.Workflow.Compiler (type path; source default PathToAtomicsFolder\..\ExternalPayloads\svchost.exe)
• mwcpath: Default location of Microsoft.Workflow.Compiler.exe (type path; source default C:\Windows\Microsoft.NET\Framework64\v4.0.30319)
• mwcname: Default name of microsoft.workflow.compiler.exe (type path; source default microsoft.workflow.compiler.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• .Net must be installed for this test to work correctly.

Test execution of a .inf using InfDefaultInstall.exe

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Infdefaultinstall.yml

Pinned Atomic procedure · 54ad7d5a-a1b5-472c-b6c4-f8090fb2daef · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• inf_to_execute: Local location of inf file (type string; source default PathToAtomicsFolder\T1218\src\Infdefaultinstall.inf)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• INF file must exist on disk at specified location (#{inf_to_execute})

Executes logon scripts configured in Group Policy.
https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/

Pinned Atomic procedure · 5bcda9cd-8e85-48fa-861d-b5a85d91d48c · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Use wlrmdr(Windows Logon Reminder executable) as a proxy binary to evade defensive countermeasures

Pinned Atomic procedure · 7816c252-b728-4ea6-a683-bd9441ca0b71 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• payload_path: Path to the executable (type String; source default C:\Windows\System32\calc.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Emulates attack with Microsoft.Workflow.Compiler.exe running a .Net assembly that launches calc.exe

Pinned Atomic procedure · 7cbb0f26-a4c1-4f77-b180-a009aa05637e · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• xml_payload: XML to execution (type path; source default PathToAtomicsFolder\T1218\src\T1218.xml)
• mwcpath: Default location of Microsoft.Workflow.Compiler.exe (type path; source default C:\Windows\Microsoft.NET\Framework64\v4.0.30319)
• mwcname: Default name of microsoft.workflow.compiler.exe (type path; source default microsoft.workflow.compiler.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• .Net must be installed for this test to work correctly.

RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).

One of the PowerShell functions called by RemoteFXvGPUDisablement.exe is Get-VMRemoteFXPhysicalVideoAdapter, a part of the Hyper-V module. This atomic test influences RemoteFXvGPUDisablement.exe to execute custom PowerShell code by using a technique referred to as "PowerShell module load-order hijacking" where a module containing, in this case, an implementation of the Get-VMRemoteFXPhysicalVideoAdapter is loaded first by way of introducing a temporary module into the first directory listed in the %PSModulePath% environment variable or within a user-specified module directory outside of %PSModulePath%. Upon execution the temporary module is deleted.

Invoke-ATHRemoteFXvGPUDisablementCommand is used in this test to demonstrate how a PowerShell host executable can be directed to user-supplied PowerShell code without needing to supply anything at the command-line. PowerShell code execution is triggered when supplying the "Disable" argument to RemoteFXvGPUDisablement.exe.

The Invoke-ATHRemoteFXvGPUDisablementCommand function outputs all relevant execution-related artifacts.

Reference: https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1

Pinned Atomic procedure · 9ebe7901-7edf-45c0-b5c7-8366300919db · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• module_name: Specifies a temporary module name to use. If -ModuleName is not supplied, a 16-character random temporary module name is used. A PowerShell module can have any name. Because Get-VMRemoteFXPhysicalVideoAdapter abuses module load order, a module name must be specified. (type string; source default foo)
• module_path: Specifies an alternate, non-default PowerShell module path for RemoteFXvGPUDisablement.exe. If -ModulePath is not specified, the first entry in %PSModulePath% will be used. Typically, this is %USERPROFILE%\Documents\WindowsPowerShell\Modules. (type string; source default $PWD)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• The AtomicTestHarnesses module must be installed and Invoke-ATHRemoteFXvGPUDisablementCommand must be exported in the module.

Provlaunch.exe executes a command defined in the Registry. This test will create the necessary registry keys and values, then run provlaunch.exe to execute an arbitrary command.
- https://twitter.com/0gtweet/status/1674399582162153472
- https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
Registry keys are deleted after successful execution.

Pinned Atomic procedure · ab76e34f-28bf-441f-a39c-8db4835b89cc · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Execute arbitrary dll. Requires at least Windows 8/2012. Also note this dll can be served up via SMB

Pinned Atomic procedure · ad2c17ed-f626-4061-b21e-b9804a6f3655 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• dll_payload: DLL to execute (type path; source default PathToAtomicsFolder\T1218\src\Win32\T1218-2.dll)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• T1218-2.dll must exist on disk at specified location (#{dll_payload})

This test simulates an adversary copying `customshellhost.exe` and `calc.exe` from `C:\windows\system32\` to `C:\temp\`, renaming `calc.exe` to `explorer.exe`. Upon execution, customshellhost.exe will spawn calc.exe. Note this will only work on Windows 10 or 11. LOLBAS BishopFox

Pinned Atomic procedure · b1eeb683-90bb-4365-bbc2-2689015782fe · windows · powershell.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• dest_path: Directory to copy files into (type path; source default C:\test)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Injects arbitrary DLL into running process specified by process ID. Requires Windows 10.

Pinned Atomic procedure · c426dacf-575d-4937-8611-a148a86a5e61 · windows · command_prompt.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• process_id: PID of process receiving injection (type string; source default 1000)
• dll_payload: DLL to inject (type path; source default PathToAtomicsFolder\T1218\src\x64\T1218.dll)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• T1218.dll must exist on disk at specified location (#{dll_payload})

Emulates attack via documents through protocol handler in Microsoft Office. On successful execution you should see Microsoft Word launch a blank file.

Pinned Atomic procedure · db020456-125b-4c8b-a4a7-487df8afb5a2 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• remote_url: url to document (type url; source default https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218/src/T1218Test.docx)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Microsoft Word must be installed

Executes a process under a trusted Microsoft signed binary,mseddge. This test will spawn "calc.exe" as a child process of msedge.exe
- https://lolbas-project.github.io/lolbas/Binaries/Msedge/

Pinned Atomic procedure · e5eedaed-ad42-4c1e-8783-19529738a349 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Executes startup scripts configured in Group Policy
https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/

Pinned Atomic procedure · f8da74bb-21b8-4af9-8d84-f2c8e4a220e3 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

• M1021 Restrict Web-Based Content

  Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.

• M1026 Privileged Account Management

  Restrict execution of particularly vulnerable binaries to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage.

• M1037 Filter Network Traffic

  Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.

• M1038 Execution Prevention

  Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network.

• M1042 Disable or Remove Feature or Program

  Many native binaries may not be necessary within a given environment.

• M1050 Exploit Protection

  Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using using trusted binaries to bypass application control.