| name | T1127_trusted-developer-utilities-proxy-execution |
| description | Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. |
| category | configuration |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1127","defense-evasion","windows"] |
| technique_id | T1127 |
| tactic | defense-evasion |
| all_tactics | ["defense-evasion"] |
| platforms | ["Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1127 |
| tech_stack | ["windows"] |
| cwe_ids | ["CWE-693"] |
| chains_with | ["T1127.001","T1127.002","T1127.003"] |
| prerequisites | [] |
| severity_boost | {"T1127.001":"Chain with T1127.001 for deeper attack path","T1127.002":"Chain with T1127.002 for deeper attack path","T1127.003":"Chain with T1127.003 for deeper attack path"} |
T1127 Trusted Developer Utilities Proxy Execution
High-Level Description
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.
Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them. However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging Trusted Developer Utilities Proxy Execution to run their malicious code, adversaries may bypass Smart App Control protections.
Kill Chain Phase
Platforms: Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Lolbin Jsc.exe compile javascript to exe
Use jsc.exe to compile javascript code stored in scriptfile.js and output scriptfile.exe.
https://lolbas-project.github.io/lolbas/Binaries/Jsc/
https://www.phpied.com/make-your-javascript-a-windows-exe/
Supported Platforms: windows
copy "#{filename}" %TEMP%\hello.js
#{jscpath}\#{jscname} %TEMP%\hello.js
Dependencies:
- JavaScript code file must exist on disk at specified location (#{filename})
