Techniques › T1127 › AN0488
AN0488 Analytic 0488
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A trusted/signed developer utility (parent) is executed in a non-developer context and (a) spawns suspicious children (e.g., powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, wscript.exe), (b) loads unsigned/user-writable DLLs, (c) writes and then runs a new PE from user-writable paths, and/or (d) immediately makes outbound network connections.</p>
- Detects
- T1127 Trusted Developer Utilities Proxy Execution
- Part of
- DET0172 Behavior-chain, platform-aware detection strategy for T1127 Trusted Developer Utilities Proxy Execution (Windows)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:AppLocker | AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy | DC0034 Process Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation window between developer utility execution, payload write, and network egress (e.g., 0–30 minutes). |
AllowedUtilitiesList | Org-specific list of dev utilities legitimately used on build/dev hosts to suppress noise. |
DeveloperHosts | List of known developer/build systems where these tools are expected; raise severity off-host. |
SuspiciousChildList | Child processes considered high-risk when spawned by dev utilities (powershell.exe, rundll32.exe, regsvr32.exe, cmd.exe, wscript.exe, mshta.exe). |
RarePathRegex | Regex of user-writable or atypical paths (e.g., %TEMP%, %APPDATA%, recycle bin, public profile) for payload drops. |
UnsignedOrInvalidSignatureOnly | Toggle to alert only when child/payload is unsigned or signature invalid to reduce noise. |
ParentProcessAllowList | Known orchestrators (e.g., CI/CD agents) that often run these utilities legitimately. |
NetworkReputationThreshold | Heuristic for rare/unknown destination (no DNS reputation, new domain, geo outside region). |