System Script Proxy Execution

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.[1] This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.[2]

ID: T1216
Sub-techniques:  T1216.001
Tactic: Defense Evasion
Platforms: Windows
Defense Bypassed: Application control, Digital Certificate Validation
Contributors: Praetorian; Wes Hurd
Version: 2.0
Created: 18 April 2018
Last Modified: 18 April 2022

Mitigations

ID Mitigation Description
M1038 Execution Prevention

Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

DS0009 Process Process Creation

Monitor script processes, such as `cscript that may be used to proxy execution of malicious files.

DS0012 Script Script Execution

Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

References