System Binary Proxy Execution
- ID
- T1218
- Tactics
- TA0005 Stealth
- Platforms
- Linux, macOS, Windows
- Data sources
- Process Creation, Network Connection Creation, Module Load
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.[1] Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.
Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.[2][3]
Sub-techniques (14)
- T1218.001 Compiled HTML File
- T1218.002 Control Panel
- T1218.003 CMSTP
- T1218.004 InstallUtil
- T1218.005 Mshta
- T1218.007 Msiexec
- T1218.008 Odbcconf
- T1218.009 Regsvcs/Regasm
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1218.012 Verclsid
- T1218.013 Mavinject
- T1218.014 MMC
- T1218.015 Electron Applications
Detection
- DET0081 Detection of Proxy Execution via Trusted Signed Binaries Across Platforms
Data components: Process Creation, Network Connection Creation, Module Load
Mitigations (6)
- M1021 Restrict Web-Based Content
Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.
- M1026 Privileged Account Management
Restrict execution of particularly vulnerable binaries to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage.
- M1037 Filter Network Traffic
Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.
- M1038 Execution Prevention
Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network.
- M1042 Disable or Remove Feature or Program
Many native binaries may not be necessary within a given environment.
- M1050 Exploit Protection
Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using using trusted binaries to bypass application control.