t1218-system-binary-proxy-execution

name	T1218_system-binary-proxy-execution
description	Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1218","defense-evasion","windows","linux","macos"]
technique_id	T1218
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Windows","Linux","macOS"]
mitre_url	https://attack.mitre.org/techniques/T1218
tech_stack	["windows","linux","macos"]
cwe_ids	["CWE-693"]
chains_with	["T1218.001","T1218.002","T1218.003","T1218.004","T1218.005","T1218.007","T1218.008","T1218.009","T1218.010","T1218.011","T1218.012","T1218.013","T1218.014","T1218.015"]
prerequisites	[]
severity_boost	{"T1218.001":"Chain with T1218.001 for deeper attack path","T1218.002":"Chain with T1218.002 for deeper attack path","T1218.003":"Chain with T1218.003 for deeper attack path"}

T1218 System Binary Proxy Execution

High-Level Description

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Windows, Linux, macOS

What to Check

• Identify if System Binary Proxy Execution technique is applicable to target environment
• Check Windows systems for indicators of System Binary Proxy Execution
• Check Linux systems for indicators of System Binary Proxy Execution
• Check macOS systems for indicators of System Binary Proxy Execution
• Verify mitigations are bypassed or absent (6 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: mavinject - Inject DLL into running process

Injects arbitrary DLL into running process specified by process ID. Requires Windows 10.

Supported Platforms: windows Elevation Required: Yes

mavinject.exe #{process_id} /INJECTRUNNING "#{dll_payload}"

Dependencies:

• T1218.dll must exist on disk at specified location (#{dll_payload})

Atomic Test 2: Register-CimProvider - Execute evil dll

Execute arbitrary dll. Requires at least Windows 8/2012. Also note this dll can be served up via SMB

Supported Platforms: windows