Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.[1] Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.
Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.[2][3]
| ID | Name | Description |
|---|---|---|
| G0032 | Lazarus Group |
Lazarus Group lnk files used for persistence have abused the Windows Update Client ( |
| G1017 | Volt Typhoon |
Volt Typhoon has used native tools and processes including living off the land binaries or "LOLBins" to maintain and expand access to the victim networks.[6] |
| ID | Mitigation | Description |
|---|---|---|
| M1042 | Disable or Remove Feature or Program |
Many native binaries may not be necessary within a given environment. |
| M1038 | Execution Prevention |
Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network. |
| M1050 | Exploit Protection |
Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using using trusted binaries to bypass application control. |
| M1037 | Filter Network Traffic |
Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic. |
| M1026 | Privileged Account Management |
Restrict execution of particularly vulnerable binaries to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage. |
| M1021 | Restrict Web-Based Content |
Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0081 | Detection of Proxy Execution via Trusted Signed Binaries Across Platforms | AN0226 |
Execution of trusted, Microsoft-signed binaries such as |
| AN0227 |
Execution of trusted system binaries (e.g., |
||
| AN0228 |
Use of system binaries such as |