Trusted Developer Utilities Proxy Execution
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute...
BY SOURCE
PROCEDURES (23)
Auto-extracted: 7 detections for process creation monitoring
Auto-extracted: 4 detections for network connection monitoring
Auto-extracted: 2 detections for script block
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for script execution monitoring
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for child process
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for module load monitoring
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for powershell