Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1218_system-binary-proxy-execution
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
Passed 21 of 22 test cases with the skill, and 15 of 22 without it.
and 10 more in the full report
6 fixed15 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
When testing Windows SysWow64 directory binaries for DLL loading vulnerabilities, security analysts often test regsvr32. What specific SysWow64 executable and command switch allows loading a CIM provider DLL or arbitrary DLL file, including over SMB shares?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies Register-CimProvider.exe located in SysWow64. | Missed | Passed |
| Uses the -Path parameter to supply the DLL payload. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.
Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.
Platforms: Windows, Linux, macOS
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Injects arbitrary DLL into running process specified by process ID. Requires Windows 10.
Supported Platforms: windows Elevation Required: Yes
mavinject.exe #{process_id} /INJECTRUNNING "#{dll_payload}"
test cases passed, vs 15 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.