Complete technique description
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. [LOLBAS Project] Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands. [split man page][GTFO split]
Adversaries may abuse application binaries installed on a system for proxy execution of malicious code or domain-specific commands. These commands could be used to target local resources on the device or networked devices within the environment through defined APIs (Execution through API) or application-specific programming languages (e.g., MicroSCADA SCIL). Application binaries may be signed by the developer or generally trusted by the operators, analysts, and monitoring tools accustomed to the environment. These applications may be developed and/or directly provided by the device vendor to enable configuration, management, and operation of their devices without many alternatives.
Adversaries may seek to target these trusted application binaries to execute or send commands without the development of custom malware. For example, adversaries may target a SCADA server binary which has the existing ability to send commands to substation devices, such as through IEC 104 command messages. Proxy execution may still require the development of custom tools to hook into the application binary’s execution.
Official technique definition · Open in the interactive matrix
Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
Command Execution · source-mapped
DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.
Providers and collection configuration
- Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
- Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
- On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.
Required normalized fields: interpreter, command_line, actor_uid, session_id.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0064",
"collector": "illustrative-lab-collector",
"observation": {
"interpreter": "/bin/sh",
"command_line": "printf LAB_TELEMETRY_CHECK",
"actor_uid": 1000,
"session_id": "lab-session-1"
}
}
Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.
Network Traffic Content · source-mapped
DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.
Providers and collection configuration
- Zeek: Connection and protocol metadata from traffic visible to the sensor.
- Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
- Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
- Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
- Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.
Required normalized fields: flow_id, protocol, method, path, payload_excerpt.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0085",
"collector": "illustrative-lab-collector",
"observation": {
"flow_id": "lab-flow-1",
"protocol": "http",
"method": "GET",
"path": "/lab-check",
"payload_excerpt": "LAB_TELEMETRY_CHECK"
}
}
Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.
Process Creation · source-mapped
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Providers and collection configuration
- Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
- Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
- Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
- On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
- Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
- For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>
This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}
Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Simulation design and documented procedures
Atomic evidence: no compatible candidate in this snapshot. Live lab status: not run for these imported procedures.
Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.
No compatible Atomic procedure is present in this pinned evidence set. Technical feasibility has not been ruled out. A custom procedure must define the behavior, target, collection point, success observable and rollback before execution.
Technique-specific experiment contract
- Choose one procedure implementing T0894 System Binary Proxy Execution; identify the observable behavior in the source definition, not just its tactic.
- Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
- Enable the collection sources above and verify a benign baseline reaches the detector.
- Run only the approved isolated scenario; capture native events and an independent behavior observable.
- Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.