System Script Proxy Execution
- ID
- T1216
- Tactics
- TA0005 Stealth
- Platforms
- Windows
- Data sources
- Process Creation, Command Execution, Module Load, Process Access, File Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.[1] This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.[2]
Sub-techniques (2)
Detection
- DET0466 Detection of Script-Based Proxy Execution via Signed Microsoft Utilities
Data components: Process Creation, Command Execution, Module Load, Process Access, File Creation
Mitigations (1)
- M1038 Execution Prevention
Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.