Signed Script Proxy Execution

Adversaries may use scripts signed with trusted certificates to proxy execution of malicious files. Several Microsoft signed scripts that are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.[1]

ID: T1216
Sub-techniques:  T1216.001
Tactic: Defense Evasion
Platforms: Windows
Permissions Required: User
Data Sources: Process command-line parameters, Process monitoring
Defense Bypassed: Application control, Digital Certificate Validation
Contributors: Praetorian
Version: 1.1
Created: 18 April 2018
Last Modified: 20 June 2020

Mitigations

Mitigation Description
Execution Prevention

Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.

Detection

Monitor script processes, such as cscript, and command-line parameters for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

References