System Binary Proxy Execution
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Micr...
BY SOURCE
PROCEDURES (89)
Auto-extracted: 52 detections for process creation monitoring
Auto-extracted: 13 detections for child process
Auto-extracted: 13 detections for download
Auto-extracted: 8 detections for suspicious
Auto-extracted: 7 detections for bypass
Auto-extracted: 6 detections for network connection monitoring
Auto-extracted: 6 detections for powershell
Auto-extracted: 5 detections for powershell
Auto-extracted: 5 detections for general monitoring
Auto-extracted: 4 detections for script execution monitoring
Auto-extracted: 4 detections for file monitoring
Auto-extracted: 4 detections for remote
Auto-extracted: 3 detections for anomal
Auto-extracted: 3 detections for powershell
Auto-extracted: 3 detections for unusual
Auto-extracted: 3 detections for unusual
Auto-extracted: 3 detections for lateral
Auto-extracted: 3 detections for event log
Auto-extracted: 3 detections for persist
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for child process
Auto-extracted: 2 detections for registry
Auto-extracted: 2 detections for startup
Auto-extracted: 2 detections for registry
Auto-extracted: 2 detections for command and control
Auto-extracted: 2 detections for lsass
Auto-extracted: 2 detections for phish
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for dns
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for scheduled task
Auto-extracted: 2 detections for lsass
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for remote
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for ntds
Auto-extracted: 1 detections for dll side
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for ntds
Auto-extracted: 1 detections for module load monitoring
Auto-extracted: 1 detections for privilege