MITRE ATT&CK Technique
T1218System Binary Proxy Execution
- First Reported
- Dec 31, 2024
- Latest Reported
- Sep 29, 2026
Official Description
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.
Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)
Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)
- Tactics
- Stealth
- Platforms
- Linux, macOS, Windows
- MITRE Version
- 4.0
- Last Modified
- May 12, 2026
Sub-techniques (14)
Reported Context (19)
- The delivery chain used legitimate Windows utilities to retrieve additional components. Star Blizzard Expands Phishing Campaigns With RedFlick and CosmicPulse
- The reconstructed LNK/script chain invokes Windows ftp.exe with scripted input; dynamic execution of that chain was not reproduced. Lab Reconstructs QUICSILVER Backdoor Delivered Through a VHD
- The PoC uses the signed wermgr.exe as the SYSTEM execution vehicle for the planted DLL. ShieldBreak PoC Uses Windows Defender Cleanup Race for SYSTEM Privilege Escalation
- The LNK launches the legitimate ftp.exe binary to execute commands stored in a local script. Operation QUICSILVER Uses Disguised VHDs to Target Myanmar Government Personnel
- Fallback mechanisms abuse trusted Microsoft-signed binaries for code execution and defense evasion. Veil#Drop Uses Blogspot-Hosted Payloads to Deliver PureLog Stealer
CVE (2)
Malware (23)
People (11)
Threat Actors (18)
MITRE ATT&CK (86)
Vendors (13)
Products (43)
Tools (26)
Industries (23)
Countries (19)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.