Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1127_trusted-developer-utilities-proxy-execution
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.
Passed 17 of 23 test cases with the skill, and 13 of 23 without it.
and 2 more in the full report
5 fixed13 passed either way6 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
In studying legacy application whitelisting bypasses via developer tools, researchers study early bypass writeups for tools like RCSI and DNX. Which researcher published these bypass analysis posts?
| Checked | Without skill | With skill |
|---|---|---|
| References research by enigma0x3 | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.
Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them. However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging Trusted Developer Utilities Proxy Execution to run their malicious code, adversaries may bypass Smart App Control protections.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Use jsc.exe to compile javascript code stored in scriptfile.js and output scriptfile.exe. https://lolbas-project.github.io/lolbas/Binaries/Jsc/ https://www.phpied.com/make-your-javascript-a-windows-exe/
Supported Platforms: windows
copy "#{filename}" %TEMP%\hello.js
#{jscpath}\#{jscname} %TEMP%\hello.js
test cases passed, vs 13 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.