Techniques › T1127
T1127 Trusted Developer Utilities Proxy Execution
stealth · execution — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
20
Sigma rules tagged attack.t1127
0
KEV CVEs mapped here
<p>Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.</p><p>Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them. However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging Trusted Developer Utilities Proxy Execution to run their malicious code, adversaries may bypass Smart App Control protections.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0172 Behavior-chain, platform-aware detection strategy for T1127 Trusted Developer Utilities Proxy Execution (Windows) v1.0
AN0488 WindowsA trusted/signed developer utility (parent) is executed in a non-developer context and (a) spawns suspicious children (e.g., powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, wscript.exe), (b) loads unsigned/user-writable DLLs, (c) writes and then runs a new PE from user-writable paths, and/or (d) immediately makes outbound network connections.WinEventLog:AppLocker
AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy→ DC0034 Process MetadataTunable:TimeWindowAllowedUtilitiesListDeveloperHostsSuspiciousChildListRarePathRegexUnsignedOrInvalidSignatureOnlyParentProcessAllowListNetworkReputationThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1127
Author: Agro (@agro_sev) oscd.community
· 2020-10-10 (modified 2022-12-09) · logsource: product=windows category=process_creation · 0152550d-3a26-4efd-9f0e-54a0b28ae2f3
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-09 · logsource: product=windows category=process_creation · 18749301-f1c5-4efc-a4c3-276ff1f5b6f8
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-09 (modified 2023-08-03) · logsource: product=windows category=process_creation · 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e
Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
Author: Nik Seetharaman, frack113
· 2019-01-16 (modified 2023-02-03) · logsource: product=windows category=process_creation · 419dbf2b-8a9b-4bea-bf99-7544b050ec8d
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-01 · logsource: product=windows category=process_creation · 49be8799-7b4d-4fda-ad23-cafbefdebbc5
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-02 · logsource: product=windows category=process_creation · 4eddc365-79b4-43ff-a9d7-99422dc34b93
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.
Author: frack113
· 2022-05-02 (modified 2024-04-24) · logsource: product=windows category=process_creation · 52788a70-f1da-40dd-8fbd-73b5865d6568
Detects the execution of the "jsc.exe" (JScript Compiler).
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-09 (modified 2023-02-03) · logsource: product=windows category=process_creation · 6640f31c-01ad-49b5-beb5-83498a5cd8bd
Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2022-05-07 (modified 2022-05-16) · logsource: product=windows category=process_creation · 850d55f9-6eeb-4492-ad69-a72338f65ba4
Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-14 · logsource: product=windows category=process_creation · 9ccba514-7cb6-4c5c-b377-700758f2f120
Detects potentially suspicious child processes of "aspnet_compiler.exe".
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-14 (modified 2025-02-24) · logsource: product=windows category=process_creation · 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622
Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
Author: frack113
· 2021-11-24 (modified 2025-02-24) · logsource: product=windows category=process_creation · a01b8329-5953-4f73-ae2d-aa01e1f35f00
Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.
Author: Agro (@agro_sev) oscd.communitly
· 2020-10-13 (modified 2022-02-25) · logsource: product=windows category=process_creation · a746c9b8-a2fb-4ee5-a428-92bee9e99060
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Author: Michael R. (@nahamike01)
· 2020-03-08 (modified 2022-07-14) · logsource: product=windows category=process_creation · a9e416a8-e613-4f8b-88b8-a7d1d1af2f61
Detects the execution of CSharp interactive console by PowerShell
Author: frack113
· 2022-05-16 · logsource: product=windows category=process_creation · b27077d6-23e6-45d2-81a0-e2b356eea5fd
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2019-10-26 (modified 2024-04-22) · logsource: product=windows category=process_creation · b5c7395f-e501-4a08-94d4-57fe7a9da9d2
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Author: frack113
· 2022-05-16 (modified 2022-06-02) · logsource: product=windows category=create_remote_thread · c15e99a3-c474-48ab-b9a7-84549a7a9d16
Detects a remote thread creation of Ttdinject.exe used as proxy
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-11-01 · logsource: product=windows category=process_creation · d047726b-c71c-4048-a99b-2e2f50dc107d
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
Author: Max Altgelt (Nextron Systems)
· 2022-04-06 · logsource: product=windows category=process_creation · df1f26d3-bea7-4700-9ea2-ad3e990cf90e
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Author: Micah Babinski
· 2025-11-25 · logsource: product=windows category=file_event · e890acee-d488-420e-8f20-d9b19b3c3d43
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.