T1127ExecutionStealth
Trusted Developer Utilities Proxy Execution
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
20 Sigma rules tagged T1127Trusted Developer Utilities Proxy ExecutionT112720 general rules
- Kavremover Dropped Binary LOLBIN Usagehightest
- Potential Arbitrary Code Execution Via Node.EXEhightest
- Potentially Suspicious ASP.NET Compilation Via AspNetCompilerhightest
- Remote Thread Creation Ttdinject.exe Proxyhightest
- Suspicious Child Process of AspNetCompilerhightest
- Suspicious Use of CSharp Interactive Consolehightest
- Suspicious File Created by ArcSOC.exehighexperimental
- AspNetCompiler Executionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Trusted Developer Utilities Proxy Execution
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.