T1216 System Script Proxy Execution

T1216 System Script Proxy Execution

High-Level Description

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Windows

What to Check

• Identify if System Script Proxy Execution technique is applicable to target environment
• Check Windows systems for indicators of System Script Proxy Execution
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: SyncAppvPublishingServer Signed Script PowerShell Command Execution

Executes the signed SyncAppvPublishingServer script with options to execute an arbitrary PowerShell command. Upon execution, calc.exe will be launched.

Supported Platforms: windows

C:\windows\system32\SyncAppvPublishingServer.vbs "\n;#{command_to_execute}"

Atomic Test 2: manage-bde.wsf Signed Script Command Execution

Executes the signed manage-bde.wsf script with options to execute an arbitrary command.