{"id":"T1216","name":"System Script Proxy Execution","url":"https://attack.mitre.org/techniques/T1216","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0466","stix_id":"x-mitre-detection-strategy--8ac2b0d0-a589-4c72-9287-a7d9e47065a9","name":"Detection of Script-Based Proxy Execution via Signed Microsoft Utilities","url":"https://attack.mitre.org/detectionstrategies/DET0466","analytics":[{"id":"AN1288","stix_id":"x-mitre-analytic--84e969fd-a0ee-425f-a7dd-ae10e170d45a","name":"Analytic 1288","description":"Execution of Microsoft-signed scripts (e.g., pubprn.vbs, installutil.exe, wscript.exe, cscript.exe) used to proxy execution of untrusted or external binaries. Behavior is detected through command-line process lineage, child process spawning, and unsigned payload execution from signed parent.","url":"https://attack.mitre.org/detectionstrategies/DET0466#AN1288","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ParentProcessName","description":"Environment-specific paths to script interpreters like wscript.exe, cscript.exe, pubprn.vbs, or installutil.exe."},{"field":"TimeWindow","description":"Time delta between signed script execution and suspicious child process creation."},{"field":"ChildCommandLineRegex","description":"Regex pattern used to detect malicious payload execution (e.g., download cradle, PowerShell decode)."},{"field":"SignedToUnsignedTransition","description":"Indicates whether the parent is signed by Microsoft but child is unsigned or unknown."}],"live":true,"detection_strategies":["DET0466"],"techniques":["T1216"]}],"live":true,"version":"1.0","techniques":["T1216"]}],"sigma_rules":[{"id":"0403d67d-6227-4ea8-8145-4e72db7da120","title":"UtilityFunctions.ps1 Proxy Dll","author":"frack113","status":"test","level":"medium","date":"2022-05-28","modified":null,"description":"Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.","references":["https://lolbas-project.github.io/lolbas/Scripts/UtilityFunctions/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_utilityfunctions.yml","techniques":["T1216"],"cves":[]},{"id":"074e0ded-6ced-4ebd-8b4d-53f55908119d","title":"AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl","author":"Julia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-06","modified":"2022-10-09","description":"Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)","references":["https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_winrm_awl_bypass.yml","techniques":["T1216"],"cves":[]},{"id":"18988e1b-9087-4f8a-82fe-0414dce49878","title":"Execute Code with Pester.bat as Parent","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-08-20","modified":null,"description":"Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)","references":["https://twitter.com/Oddvarmoe/status/993383596244258816","https://twitter.com/_st0pp3r_/status/1560072680887525378"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_pester.yml","techniques":["T1059.001","T1216"],"cves":[]},{"id":"1e0e1a81-e79b-44bc-935b-ddb9c8006b3d","title":"Potential Script Proxy Execution Via CL_Mutexverifiers.ps1","author":"Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova, frack113","status":"test","level":"medium","date":"2022-05-21","modified":"2023-08-17","description":"Detects the use of the Microsoft signed script \"CL_mutexverifiers\" to proxy the execution of additional PowerShell script commands","references":["https://lolbas-project.github.io/lolbas/Scripts/CL_mutexverifiers/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_powershell_cl_mutexverifiers.yml","techniques":["T1216"],"cves":[]},{"id":"36475a7d-0f6d-4dce-9b01-6aeb473bbaf1","title":"SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code","author":"frack113","status":"test","level":"medium","date":"2021-07-16","modified":"2022-06-22","description":"Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md","https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml","techniques":["T1218","T1216"],"cves":[]},{"id":"59e938ff-0d6d-4dc3-b13f-36cc28734d4e","title":"Execute Code with Pester.bat","author":"Julia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-08","modified":"2023-11-09","description":"Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)","references":["https://twitter.com/Oddvarmoe/status/993383596244258816","https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml","techniques":["T1059.001","T1216"],"cves":[]},{"id":"7d4aaec2-08ed-4430-8b96-28420e030e04","title":"Uncommon Sigverif.EXE Child Process","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-19","modified":"2024-08-27","description":"Detects uncommon child processes spawning from \"sigverif.exe\", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.\n","references":["https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/","https://twitter.com/0gtweet/status/1457676633809330184"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_sigverif_uncommon_child_process.yml","techniques":["T1216"],"cves":[]},{"id":"84b14121-9d14-416e-800b-f3b829c5a14d","title":"Suspicious CustomShellHost Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-19","modified":"2025-10-29","description":"Detects the execution of CustomShellHost.exe where the child isn't located in 'C:\\Windows\\explorer.exe'. CustomShellHost is a known LOLBin that can be abused by attackers for defense evasion techniques.\n","references":["https://github.com/LOLBAS-Project/LOLBAS/pull/180","https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_customshellhost_susp_exec.yml","techniques":["T1216"],"cves":[]},{"id":"9df0dd3a-1a5c-47e3-a2bc-30ed177646a0","title":"Remote Code Execute via Winrm.vbs","author":"Julia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-07","modified":"2023-03-03","description":"Detects an attempt to execute code or create service on remote host via winrm.vbs.","references":["https://twitter.com/bohops/status/994405551751815170","https://redcanary.com/blog/lateral-movement-winrm-wmi/","https://lolbas-project.github.io/lolbas/Scripts/Winrm/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml","techniques":["T1216"],"cves":[]},{"id":"a0459f02-ac51-4c09-b511-b8c9203fc429","title":"Potential Process Execution Proxy Via CL_Invocation.ps1","author":"Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova","status":"test","level":"medium","date":"2020-10-14","modified":"2023-08-17","description":"Detects calls to \"SyncInvoke\" that is part of the \"CL_Invocation.ps1\" script to proxy execution using \"System.Diagnostics.Process\"","references":["https://lolbas-project.github.io/lolbas/Scripts/Cl_invocation/","https://twitter.com/bohops/status/948061991012327424"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_powershell_cl_invocation.yml","techniques":["T1216"],"cves":[]},{"id":"c363385c-f75d-4753-a108-c1a8e28bdbda","title":"Potential Manage-bde.wsf Abuse To Proxy Execution","author":"oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-10-13","modified":"2023-02-03","description":"Detects potential abuse of the \"manage-bde.wsf\" script as a LOLBIN to proxy execution","references":["https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/","https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712","https://twitter.com/bohops/status/980659399495741441","https://twitter.com/JohnLaTwC/status/1223292479270600706","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml","techniques":["T1216"],"cves":[]},{"id":"c57872c7-614f-4d7f-a40d-b78c8df2d30d","title":"Assembly Loading Via CL_LoadAssembly.ps1","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-05-21","modified":"2023-08-17","description":"Detects calls to \"LoadAssemblyFromPath\" or \"LoadAssemblyFromNS\" that are part of the \"CL_LoadAssembly.ps1\" script. This can be abused to load different assemblies and bypass App locker controls.","references":["https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/","https://lolbas-project.github.io/lolbas/Scripts/CL_LoadAssembly/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_powershell_cl_loadassembly.yml","techniques":["T1216"],"cves":[]},{"id":"d353dac0-1b41-46c2-820c-d7d2561fc6ed","title":"AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File","author":"Julia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-06","modified":"2022-11-28","description":"Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)","references":["https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1216"],"path":"rules/windows/file/file_event/file_event_win_winrm_awl_bypass.yml","techniques":["T1216"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}