System Binary Proxy Execution

T1218

Technique with 14 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.

Detection rules323

Rules on DetectionCode tagged with T1218 or one of its sub-techniques.

Sigma221

Rule	Level	Log source	Technique
HackTool - F-Secure C3 Load by Rundll32	critical	windows / process_creation	T1218.011
Arbitrary File Download Via IMEWDBLD.EXE	high	windows / process_creation	T1218
BaaUpdate.exe Suspicious DLL Load	high	windows / image_load	T1218
Bad Opsec Defaults Sacrificial Processes With Improper Arguments	high	windows / process_creation	T1218.011
Bypass UAC via CMSTP	high	windows / process_creation	T1218.003
CMSTP App Paths Registry Key Modification	high	windows / registry_event	T1218.003
CMSTP Execution Process Access	high	windows / process_access	T1218.003
CMSTP Execution Process Creation	high	windows / process_creation	T1218.003
CMSTP UAC Bypass via COM Object Access	high	windows / process_creation	T1218.003
CobaltStrike Load by Rundll32	high	windows / process_creation	T1218.011
Control Panel Items	high	windows / process_creation	T1218.002
Csc.EXE Execution Form Potentially Suspicious Parent	high	windows / process_creation	T1218.005
Curl Download And Execute Combination	high	windows / process_creation	T1218
Devtoolslauncher.exe Executes Specified Binary	high	windows / process_creation	T1218
DLL Loaded From Suspicious Location Via Cmspt.EXE	high	windows / image_load	T1218.003
Execute Pcwrun.EXE To Leverage Follina	high	windows / process_creation	T1218
Execution DLL of Choice Using WAB.EXE	high	windows / registry_set	T1218
Execution via stordiag.exe	high	windows / process_creation	T1218
Execution via WorkFolders.exe	high	windows / process_creation	T1218
File Download Via Windows Defender MpCmpRun.EXE	high	windows / process_creation	T1218
HackTool - CACTUSTORCH Remote Thread Creation	high	windows / create_remote_thread	T1218.005
HackTool - RedMimicry Winnti Playbook Execution	high	windows / process_creation	T1218.011
HTML Help HH.EXE Suspicious Child Process	high	windows / process_creation	T1218 T1218.001 T1218.010 T1218.011
Legitimate Application Dropped Archive	high	windows / file_event	T1218
Legitimate Application Dropped Executable	high	windows / file_event	T1218
Legitimate Application Dropped Script	high	windows / file_event	T1218
Legitimate Application Writing Files In Uncommon Location	high	windows / file_event	T1218
Mavinject Inject DLL Into Running Process	high	windows / process_creation	T1218.013
MMC Executing Files with Reversed Extensions Using RTLO Abuse	high	windows / process_creation	T1218.014
MpiExec Lolbin	high	windows / process_creation	T1218
MSDT Execution Via Answer File	high	windows / process_creation	T1218
MSHTA Execution with Suspicious File Extensions	high	windows / process_creation	T1218.005
Network Connection Initiated By AddinUtil.EXE	high	windows / network_connection	T1218
Obfuscated PowerShell MSI Install via WindowsInstaller COM	high	windows / process_creation	T1218.007
Odbcconf.EXE Suspicious DLL Location	high	windows / process_creation	T1218.008
OneNote.EXE Execution of Malicious Embedded Scripts	high	windows / process_creation	T1218.001
OpenWith.exe Executes Specified Binary	high	windows / process_creation	T1218
Outbound Network Connection Initiated By Cmstp.EXE	high	windows / network_connection	T1218.003
Potential LethalHTA Technique Execution	high	windows / process_creation	T1218.005
Potential NTLM Coercion Via Certutil.EXE	high	windows / process_creation	T1218
Potential PowerShell Execution Via DLL	high	windows / process_creation	T1218.011
Potential Provisioning Registry Key Abuse For Binary Proxy Execution	high	windows / process_creation	T1218
Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG	high	windows / registry_set	T1218
Potential RemoteFXvGPUDisablement.EXE Abuse	high	windows / NULL	T1218
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module	high	windows / ps_module	T1218
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock	high	windows / ps_script	T1218
Potentially Suspicious Child Process Of Regsvr32	high	windows / process_creation	T1218.010
Potentially Suspicious Child Processes Spawned by ConHost	high	windows / process_creation	T1218
Potentially Suspicious DLL Registered Via Odbcconf.EXE	high	windows / process_creation	T1218.008
Potentially Suspicious Mofcomp Execution	high	windows / process_creation	T1218
Potentially Suspicious Regsvr32 HTTP IP Pattern	high	windows / process_creation	T1218.010
Process Access via TrolleyExpress Exclusion	high	windows / process_creation	T1218.011
Proxy Execution Via Wuauclt.EXE	high	windows / process_creation	T1218
Regsvr32 DLL Execution With Suspicious File Extension	high	windows / process_creation	T1218.010
Regsvr32 Execution From Highly Suspicious Location	high	windows / process_creation	T1218.010
Remote CHM File Download/Execution Via HH.EXE	high	windows / process_creation	T1218.001
RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses	high	windows / process_creation	T1218
Remotely Hosted HTA File Executed Via Mshta.EXE	high	windows / process_creation	T1218.005
Renamed Mavinject.EXE Execution	high	windows / process_creation	T1218.013
Renamed MegaSync Execution	high	windows / process_creation	T1218
Renamed ZOHO Dctask64 Execution	high	windows / process_creation	T1218
RunDLL32 Spawning Explorer	high	windows / process_creation	T1218.011
Rundll32 UNC Path Execution	high	windows / process_creation	T1218.011
Sdiagnhost Calling Suspicious Child Process	high	windows / process_creation	T1218
Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location	high	windows / process_creation	T1218
Sensitive File Dump Via Print.EXE	high	windows / process_creation	T1218
Shell32 DLL Execution in Suspicious Directory	high	windows / process_creation	T1218.011
Suspicious AddinUtil.EXE CommandLine Execution	high	windows / process_creation	T1218
Suspicious AgentExecutor PowerShell Execution	high	windows / process_creation	T1218
Suspicious BitLocker Access Agent Update Utility Execution	high	windows / process_creation	T1218
Suspicious Child Process Of BgInfo.EXE	high	windows / process_creation	T1218
Suspicious Control Panel DLL Load	high	windows / process_creation	T1218.011
Suspicious DLL Loaded via CertOC.EXE	high	windows / process_creation	T1218
Suspicious DotNET CLR Usage Log Artifact	high	windows / file_event	T1218
Suspicious Driver/DLL Installation Via Odbcconf.EXE	high	windows / process_creation	T1218.008
Suspicious HH.EXE Execution	high	windows / process_creation	T1218 T1218.001 T1218.010 T1218.011
Suspicious JavaScript Execution Via Mshta.EXE	high	windows / process_creation	T1218.005
Suspicious Microsoft Office Child Process	high	windows / process_creation	T1218.010
Suspicious MSDT Parent Process	high	windows / process_creation	T1218
Suspicious MSHTA Child Process	high	windows / process_creation	T1218.005
Suspicious Provlaunch.EXE Child Process	high	windows / process_creation	T1218
Suspicious Regsvr32 Execution From Remote Share	high	windows / process_creation	T1218.010
Suspicious Response File Execution Via Odbcconf.EXE	high	windows / process_creation	T1218.008
Suspicious Rundll32 Activity Invoking Sys File	high	windows / process_creation	T1218.011
Suspicious Rundll32 Execution With Image Extension	high	windows / process_creation	T1218.011
Suspicious ShellExec_RunDLL Call Via Ordinal	high	windows / process_creation	T1218.011
Suspicious Speech Runtime Binary Child Process	high	windows / process_creation	T1218
Suspicious WMIC Execution Via Office Process	high	windows / process_creation	T1218.010
Suspicious WmiPrvSE Child Process	high	windows / process_creation	T1218.010
Suspicious WSL Binary Hijack via Proxy Execution	high	windows / process_creation	T1218
Suspicious WSL Binary Masquerading	high	windows / process_creation	T1218
Suspicious WSL InstallLocation Registry Key Modification Via CommandLine	high	windows / process_creation	T1218
Time Travel Debugging Utility Usage	high	windows / process_creation	T1218
Time Travel Debugging Utility Usage - Image	high	windows / image_load	T1218
Uncommon Child Process Of Setres.EXE	high	windows / process_creation	T1218
Windows Shell/Scripting Processes Spawning Suspicious Programs	high	windows / process_creation	T1218
Winrs Local Command Execution	high	windows / process_creation	T1218
Abusing Print Executable	medium	windows / process_creation	T1218
AddinUtil.EXE Execution From Uncommon Directory	medium	windows / process_creation	T1218
AgentExecutor PowerShell Execution	medium	windows / process_creation	T1218
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE	medium	windows / process_creation	T1218
Arbitrary File Download Via MSEDGE_PROXY.EXE	medium	windows / process_creation	T1218
Arbitrary File Download Via MSOHTMED.EXE	medium	windows / process_creation	T1218
Arbitrary File Download Via MSPUB.EXE	medium	windows / process_creation	T1218
Arbitrary File Download Via PresentationHost.EXE	medium	windows / process_creation	T1218
Arbitrary File Download Via Squirrel.EXE	medium	windows / process_creation	T1218
Arbitrary MSI Download Via Devinit.EXE	medium	windows / process_creation	T1218
Atbroker Registry Change	medium	windows / registry_event	T1218
Binary Proxy Execution Via Dotnet-Trace.EXE	medium	windows / process_creation	T1218
Code Execution via Pcwutl.dll	medium	windows / process_creation	T1218.011
COM Object Execution via Xwizard.EXE	medium	windows / process_creation	T1218
Created Files by Microsoft Sync Center	medium	windows / file_event	T1218
DeviceCredentialDeployment Execution	medium	windows / process_creation	T1218
Diskshadow Script Mode - Execution From Potential Suspicious Location	medium	windows / process_creation	T1218
Diskshadow Script Mode - Uncommon Script Extension Execution	medium	windows / process_creation	T1218
DLL Execution via Rasautou.exe	medium	windows / process_creation	T1218
DLL Loaded via CertOC.EXE	medium	windows / process_creation	T1218
DllUnregisterServer Function Call Via Msiexec.EXE	medium	windows / process_creation	T1218.007
DNS Query Request By Regsvr32.EXE	medium	windows / dns_query	T1218.010
Driver/DLL Installation Via Odbcconf.EXE	medium	windows / process_creation	T1218.008
Execute Files with Msdeploy.exe	medium	windows / process_creation	T1218
File Download Using ProtocolHandler.exe	medium	windows / process_creation	T1218
File Download Via InstallUtil.EXE	medium	windows / process_creation	T1218
Gpscript Execution	medium	windows / process_creation	T1218
Hidden Flag Set On File/Directory Via Chflags - MacOS	medium	macos / process_creation	T1218
Ie4uinit Lolbin Use From Invalid Path	medium	windows / process_creation	T1218
Import LDAP Data Interchange Format File Via Ldifde.EXE	medium	windows / process_creation	T1218
InfDefaultInstall.exe .inf Execution	medium	windows / process_creation	T1218
Lolbin Runexehelper Use As Proxy	medium	windows / process_creation	T1218
Lolbin Unregmp2.exe Use As Proxy	medium	windows / process_creation	T1218
Malicious PE Execution by Microsoft Visual Studio Debugger	medium	windows / process_creation	T1218
Microsoft Sync Center Suspicious Network Connections	medium	windows / network_connection	T1218
MMC Loading Script Engines DLLs	medium	windows / image_load	T1218.014
MSI Installation From Web	medium	windows / NULL	T1218 T1218.007
Msiexec Quiet Installation	medium	windows / process_creation	T1218.007
MsiExec Web Install	medium	windows / process_creation	T1218.007
Network Connection Initiated By Regsvr32.EXE	medium	windows / network_connection	T1218.010
New Capture Session Launched Via DXCap.EXE	medium	windows / process_creation	T1218
New DLL Registered Via Odbcconf.EXE	medium	windows / process_creation	T1218.008
Outbound Network Connection To Public IP Via Winlogon	medium	windows / network_connection	T1218.011
Potential Application Whitelisting Bypass via Dnx.EXE	medium	windows / process_creation	T1218
Potential Arbitrary File Download Via Cmdl32.EXE	medium	windows / process_creation	T1218
Potential Binary Impersonating Sysinternals Tools	medium	windows / process_creation	T1218
Potential Binary Proxy Execution Via Cdb.EXE	medium	windows / process_creation	T1218
Potential Binary Proxy Execution Via VSDiagnostics.EXE	medium	windows / process_creation	T1218
Potential DLL Sideloading Using Coregen.exe	medium	windows / image_load	T1218
Potential File Download Via MS-AppInstaller Protocol Handler	medium	windows / process_creation	T1218
Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution	medium	windows / process_creation	T1218
Potential Password Spraying Attempt Using Dsacls.EXE	medium	windows / process_creation	T1218
Potential Provlaunch.EXE Binary Proxy Execution Abuse	medium	windows / process_creation	T1218
Potential Register_App.Vbs LOLScript Abuse	medium	windows / process_creation	T1218
Potential Regsvr32 Commandline Flag Anomaly	medium	windows / process_creation	T1218.010
Potential WSL Binary Modification from Installed Location	medium	windows / file_event	T1218
Potential WSL InstallLocation Registry Key Modification	medium	windows / registry_set	T1218
Potentially Over Permissive Permissions Granted Using Dsacls.EXE	medium	windows / process_creation	T1218
Potentially Suspicious Cabinet File Expansion	medium	windows / process_creation	T1218
Potentially Suspicious Child Process Of DiskShadow.EXE	medium	windows / process_creation	T1218
Potentially Suspicious Child Process Of VsCode	medium	windows / process_creation	T1218
Potentially Suspicious CMD Shell Output Redirect	medium	windows / process_creation	T1218
Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location	medium	windows / process_creation	T1218.009
Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension	medium	windows / process_creation	T1218.009
Potentially Suspicious Regsvr32 HTTP/FTP Pattern	medium	windows / process_creation	T1218.010
Potentially Suspicious Rundll32 Activity	medium	windows / process_creation	T1218.011
Potentially Suspicious Rundll32.EXE Execution of UDL File	medium	windows / process_creation	T1218.011
Potentially Suspicious Self Extraction Directive File Created	medium	windows / file_executable_detected	T1218
Potentially Suspicious Wuauclt Network Connection	medium	windows / network_connection	T1218
PowerShell MSI Install via WindowsInstaller COM From Remote Location	medium	windows / process_creation	T1218
PowerShell WMI Win32_Product Install MSI	medium	windows / ps_script	T1218.007
Process Memory Dump Via Dotnet-Dump	medium	windows / process_creation	T1218
Process Proxy Execution Via Squirrel.EXE	medium	windows / process_creation	T1218
Program Executed Using Proxy/Local Command Via SSH.EXE	medium	windows / process_creation	T1218
RegAsm.EXE Initiating Network Connection To Public IP	medium	windows / network_connection	T1218.009
REGISTER_APP.VBS Proxy Execution	medium	windows / process_creation	T1218
Regsvr32 Execution From Potential Suspicious Location	medium	windows / process_creation	T1218.010
Remote File Download Via Findstr.EXE	medium	windows / process_creation	T1218
Remote Thread Creation Via PowerShell In Uncommon Target	medium	windows / create_remote_thread	T1218.011
Response File Execution Via Odbcconf.EXE	medium	windows / process_creation	T1218.008
Rundll32 Execution With Uncommon DLL Extension	medium	windows / process_creation	T1218.011
Rundll32 InstallScreenSaver Execution	medium	windows / process_creation	T1218.011
Rundll32 Internet Connection	medium	windows / network_connection	T1218.011
Scheduled Task Creation with Curl and PowerShell Execution Combo	medium	windows / process_creation	T1218
SCR File Write Event	medium	windows / file_event	T1218.011
ScreenSaver Registry Key Set	medium	windows / registry_set	T1218.011
Scripting/CommandLine Process Spawned Regsvr32	medium	windows / process_creation	T1218.010
Self Extraction Directive File Created In Potentially Suspicious Location	medium	windows / file_event	T1218
Suspicious Csi.exe Usage	medium	windows / process_creation	T1218
Suspicious MsiExec Embedding Parent	medium	windows / process_creation	T1218.007
Suspicious Msiexec Execute Arbitrary DLL	medium	windows / process_creation	T1218.007
Suspicious Msiexec Quiet Install From Remote Location	medium	windows / process_creation	T1218.007
Suspicious Rundll32 Setupapi.dll Activity	medium	windows / process_creation	T1218.011
Suspicious Vsls-Agent Command With AgentExtensionPath Load	medium	windows / process_creation	T1218
Suspicious ZipExec Execution	medium	windows / process_creation	T1218
SyncAppvPublishingServer Bypass Powershell Restriction - PS Module	medium	windows / ps_module	T1218
SyncAppvPublishingServer Execute Arbitrary PowerShell Code	medium	windows / process_creation	T1218
SyncAppvPublishingServer Execution to Bypass Powershell Restriction	medium	windows / ps_script	T1218
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code	medium	windows / process_creation	T1218
Uncommon Assistive Technology Applications Execution Via AtBroker.EXE	medium	windows / process_creation	T1218
Uncommon AddinUtil.EXE CommandLine Execution	medium	windows / process_creation	T1218
Uncommon Child Process Of AddinUtil.EXE	medium	windows / process_creation	T1218
Uncommon Child Process Of Appvlp.EXE	medium	windows / process_creation	T1218
Uncommon Child Process Of BgInfo.EXE	medium	windows / process_creation	T1218
Uncommon Child Process Of Defaultpack.EXE	medium	windows / process_creation	T1218
Uncommon Child Process Spawned By Odbcconf.EXE	medium	windows / process_creation	T1218.008
Uncommon Link.EXE Parent Process	medium	windows / process_creation	T1218
Unsigned DLL Loaded by Windows Utility	medium	windows / image_load	T1218.010 T1218.011
Use of Scriptrunner.exe	medium	windows / process_creation	T1218
Use Of The SFTP.EXE Binary As A LOLBIN	medium	windows / process_creation	T1218
Use of VisualUiaVerifyNative.exe	medium	windows / process_creation	T1218
Verclsid.exe Runs COM Object	medium	windows / process_creation	T1218
Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution	medium	windows / process_creation	T1218
Visual Studio NodejsTools PressAnyKey Renamed Execution	medium	windows / process_creation	T1218
Wlrmdr.EXE Uncommon Argument Or Child Process	medium	windows / process_creation	T1218
WSL Child Process Anomaly	medium	windows / process_creation	T1218
XBAP Execution From Uncommon Locations Via PresentationHost.EXE	medium	windows / process_creation	T1218
BitLockerTogo.EXE Execution	low	windows / process_creation	T1218
HH.EXE Execution	low	windows / process_creation	T1218.001
Indirect Command Execution By Program Compatibility Wizard	low	windows / process_creation	T1218
Insensitive Subfolder Search Via Findstr.EXE	low	windows / process_creation	T1218
Malicious Windows Script Components File Execution by TAEF Detection	low	windows / process_creation	T1218
RegAsm.EXE Execution Without CommandLine Flags or Files	low	windows / process_creation	T1218.009
Windows MSIX Package Support Framework AI_STUBS Execution	low	windows / process_creation	T1218

Splunk102

Rule	Type	Risk	Data source	Technique
Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1218.005
Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1218.005
Cisco NVM - Suspicious Network Connection From Process With No Args	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1218
CMLUA Or CMSTPLUA UAC Bypass	TTP	NULL	Sysmon EventID 7	T1218.003
Control Loading from World Writable Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.002
Detect HTML Help Renamed	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.001
Detect HTML Help Spawn Child Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.001
Detect HTML Help URL in Command Line	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1218.001
Detect HTML Help Using InfoTech Storage Handlers	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.001
Detect mshta inline hta execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.005
Detect mshta renamed	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.005
Detect MSHTA Url in Command Line	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1218.005
Detect Regasm Spawning a Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.009
Detect Regasm with Network Connection	TTP	NULL	Sysmon EventID 3	T1218.009
Detect Regasm with no Command Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.009
Detect Regsvcs Spawning a Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.009
Detect Regsvcs with Network Connection	TTP	NULL	Sysmon EventID 3	T1218.009
Detect Regsvcs with No Command Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.009
Detect Regsvr32 Application Control Bypass	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.010
Detect Rundll32 Application Control Bypass - advpack	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Detect Rundll32 Application Control Bypass - setupapi	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Detect Rundll32 Application Control Bypass - syssetup	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Detect Rundll32 Inline HTA Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.005
LOLBAS Network Connection On Uncommon Port	Anomaly	NULL	Sysmon EventID 3	T1218
LOLBAS Rare Network Connection	Anomaly	NULL	Sysmon EventID 3	T1218
LOLBAS With Network Traffic	TTP	NULL	Sysmon EventID 3	T1218
Malicious InProcServer32 Modification	TTP	NULL	Sysmon EventID 12, Sysmon EventID 13	T1218.010
Mmc LOLBAS Execution Process Spawn	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.014
Mshta spawning Rundll32 OR Regsvr32 Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.005
Possible Lateral Movement PowerShell Spawn	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1218.014
Regsvr32 Silent and Install Param Dll Loading	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.010
Regsvr32 with Known Silent Switch Cmdline	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.010
RunDLL Loading DLL By Ordinal	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Rundll32 Control RunDLL Hunt	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Rundll32 Control RunDLL World Writable Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Rundll32 DNSQuery	TTP	NULL	Sysmon EventID 22	T1218.011
Rundll32 LockWorkStation	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Rundll32 Process Creating Exe Dll Files	TTP	NULL	Sysmon EventID 11	T1218.011
Rundll32 with no Command Line Arguments with Network	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 3	T1218.011
Suspicious IcedID Rundll32 Cmdline	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Suspicious mshta child process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.005
Suspicious mshta spawn	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.005
Suspicious Regsvr32 Register Suspicious Path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.010
Suspicious Rundll32 dllregisterserver	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Suspicious Rundll32 no Command Line Arguments	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Suspicious Rundll32 PluginInit	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Suspicious Rundll32 Rename	Hunting	NULL	Sysmon EventID 1	T1218.011
Suspicious Rundll32 StartW	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
UAC Bypass MMC Load Unsigned Dll	TTP	NULL	Sysmon EventID 7	T1218.014
UAC Bypass With Colorui COM Object	TTP	NULL	Sysmon EventID 7	T1218.003
Uninstall App Using MsiExec	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.007
Verclsid CLSID Execution	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.012
Wbemprox COM Object Execution	TTP	NULL	Sysmon EventID 7	T1218.003
Windows Advanced Installer MSIX with AI_STUBS Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218
Windows Application Whitelisting Bypass Attempt via Rundll32	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Windows AppLocker Block Events	Anomaly	NULL		T1218
Windows AppLocker Execution from Uncommon Locations	Hunting	NULL		T1218
Windows AppLocker Privilege Escalation via Unauthorized Bypass	TTP	NULL		T1218
Windows AppLocker Rare Application Launch Detection	Hunting	NULL		T1218
Windows Binary Proxy Execution Mavinject DLL Injection	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.013
Windows BitLockerToGo Process Execution	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1218
Windows BitLockerToGo with Network Activity	Hunting	NULL	Sysmon EventID 22	T1218
Windows Diskshadow Proxy Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218
Windows DotNet Binary in Non Standard Path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.004
Windows Execute Arbitrary Commands with MSDT	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218
Windows Execution of Microsoft MSC File In Suspicious Path	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.014
Windows GrimResource - MMC Process Accessing APDS DLL	TTP	NULL	Windows Event Log Security 4663	T1218.014
Windows HTTP Network Communication From MSIExec	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 3, Cisco Network Visibility Module Flow Data	T1218.007
Windows InstallUtil Credential Theft	TTP	NULL	Sysmon EventID 7	T1218.004
Windows InstallUtil in Non Standard Path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.004
Windows InstallUtil Remote Network Connection	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 3, Cisco Network Visibility Module Flow Data	T1218.004
Windows InstallUtil Uninstall Option	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.004
Windows InstallUtil Uninstall Option with Network	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 3	T1218.004
Windows InstallUtil URL in Command Line	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1218.004
Windows IOBit Unlocker Extension DLL Registration via Regsvr32	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.010
Windows LOLBAS Executed As Renamed File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Windows LOLBAS Executed Outside Expected Path	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1218.011
Windows Mock Trusted Directory MSC File Creation	TTP	NULL	Sysmon EventID 11	T1218.014
Windows MSC EvilTwin Directory Path Manipulation	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218
Windows Mshta Execution In Registry	TTP	NULL	Sysmon EventID 13	T1218.005
Windows MSHTA Writing to World Writable Path	TTP	NULL	Sysmon EventID 11	T1218.005
Windows MSI Rollback Script Deleted By Non-Msiexec Process	TTP	NULL	Sysmon EventID 23, Sysmon EventID 26	T1218.007
Windows MSIExec DLLRegisterServer	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.007
Windows MsiExec HideWindow Rundll32 Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.007
Windows MSIExec Remote Download	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1218.007
Windows MSIExec Spawn Discovery Command	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.007
Windows MSIExec Spawn WinDBG	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.007
Windows MSIExec Unregister DLLRegisterServer	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.007
Windows MSIExec With Network Connections	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 3	T1218.007
Windows Odbcconf Hunting	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.008
Windows Odbcconf Load DLL	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.008
Windows Odbcconf Load Response File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.008
Windows Process Writing File to World Writable Path	Hunting	NULL	Sysmon EventID 11	T1218.005
Windows Proxy Execution of .NET Utilities via Scripts	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218
Windows Rasautou DLL Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218
Windows Regsvr32 Renamed Binary	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.010
Windows Rundll32 Apply User Settings Changes	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Windows Rundll32 Load DLL in Temp Dir	Anomaly	NULL	Sysmon EventID 1	T1218.011
Windows Rundll32 with Non-Standard File Extension	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.011
Windows System Binary Proxy Execution Compiled HTML File Decompile	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218.001
Windows System Script Proxy Execution Syncappvpublishingserver	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1218
Windows Unusual Process Load Mozilla NSS-Mozglue Module	Anomaly	NULL	Sysmon EventID 7	T1218.003

Sub-techniques14

ID	Name	Examples
T1218.001	Compiled HTML File	6
T1218.002	Control Panel	2
T1218.003	CMSTP	4
T1218.004	InstallUtil	6
T1218.005	Mshta	30
T1218.007	Msiexec	31
T1218.008	Odbcconf	3
T1218.009	Regsvcs/Regasm	1
T1218.010	Regsvr32	36
T1218.011	Rundll32	103
T1218.012	Verclsid	1
T1218.013	Mavinject	1
T1218.014	MMC	2
T1218.015	Electron Applications	2

Groups2

Lazarus Group Volt Typhoon

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples2

Groups2

Used by	Procedure example
GroupLazarus Group	Lazarus Group lnk files used for persistence have abused the Windows Update Client (`wuauclt.exe`) to execute a malicious DLL. Lazarus APT January 2022 Qualys LolZarus
GroupVolt Typhoon	Volt Typhoon has used native tools and processes including living off the land binaries or “LOLBins" to maintain and expand access to the victim networks. CISA AA24-038A PRC Critical Infrastructure February 2024

References3

GTFO split Open source
GTFOBins. (2020, November 13). split. Retrieved April 18, 2022.
LOLBAS Project Open source
Oddvar Moe et al. (2022, February). Living Off The Land Binaries, Scripts and Libraries. Retrieved March 7, 2022.
split man page Open source
Torbjorn Granlund, Richard M. Stallman. (2020, March null). split(1) — Linux manual page. Retrieved March 25, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.