T1216

Official Description

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)

Tactics: Stealth
Platforms: Windows
MITRE Version: 3.0
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Sub-techniques (2)

T1216.001 · PubPrnT1216.002 · SyncAppvPublishingServer

Reported Context (1)

Signed Script Proxy Execution was prevented in 9% of simulations. Picus Blue Report 2026 Finds Enterprise Defenses Block Just 37% of Post-Compromise Actions

CVE (10)

Malware (10)

Threat Actors (10)

MITRE ATT&CK (14)

Vendors (1)

Products (16)

Tools (3)

Industries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.