T1216Stealth
System Script Proxy Execution
Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
13 Sigma rules tagged T1216System Script Proxy ExecutionT121613 general rules
- Potential Manage-bde.wsf Abuse To Proxy Executionhightest
- Suspicious CustomShellHost Executionhightest
- Assembly Loading Via CL_LoadAssembly.ps1mediumtest
- AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xslmediumtest
- AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - Filemediumtest
- Execute Code with Pester.batmediumtest
- Execute Code with Pester.bat as Parentmediumtest
- Potential Process Execution Proxy Via CL_Invocation.ps1mediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to System Script Proxy Execution
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.