tfMITRE ATT&CK technique

Trusted Developer Utilities Proxy Execution T1127

Tactics: Execution, Stealth
Platform: Windows
Version: 2.0
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Casey Smith; Matthew Demaske, Adaptforward

Sub-techniques 328 rules across the family · 23 mapped directly to T1127 · 1 of 3 carry rules

.001MSBuild5 .002ClickOnce0 .003JamPlus0

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.[1][2][3][4] These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesTop 12%

Detection rules88th percentile · 88% of ATT&CK techniques have this many detection rules written or fewer.

Offense vs defense T1127

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 20Splunk ESCU (cumulative) · 3

first rule: 2019 Q1

Trusted Developer Utilities Proxy Execution detection strategy DET0172

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain, platform-aware detection strategy for T1127 Trusted Developer Utilities Proxy Execution (Windows)

Enterprise

1 platform

AN0488 · Windows

A trusted/signed developer utility (parent) is executed in a non-developer context and (a) spawns suspicious children (e.g., powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, wscript.exe), (b) loads unsigned/user-writable DLLs, (c) writes and then runs a new PE from user-writable paths, and/or (d) immediately makes outbound network connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process MetadataDC0034	WinEventLog:AppLocker	AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window between developer utility execution, payload write, and network egress (e.g., 0–30 minutes).
AllowedUtilitiesList	Org-specific list of dev utilities legitimately used on build/dev hosts to suppress noise.
DeveloperHosts	List of known developer/build systems where these tools are expected; raise severity off-host.
SuspiciousChildList	Child processes considered high-risk when spawned by dev utilities (powershell.exe, rundll32.exe, regsvr32.exe, cmd.exe, wscript.exe, mshta.exe).
RarePathRegex	Regex of user-writable or atypical paths (e.g., %TEMP%, %APPDATA%, recycle bin, public profile) for payload drops.
UnsignedOrInvalidSignatureOnly	Toggle to alert only when child/payload is unsigned or signature invalid to reduce noise.
ParentProcessAllowList	Known orchestrators (e.g., CI/CD agents) that often run these utilities legitimately.
NetworkReputationThreshold	Heuristic for rare/unknown destination (no DNS reputation, new domain, geo outside region).

Tests2Executorscmd 2Need elevation0 of 2Have prerequisites2Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Lolbin Jsc.exe compile javascript to exe

windows

cmd

—

Yes

Use jsc.exe to compile javascript code stored in scriptfile.js and output scriptfile.exe. https://lolbas-project.github.io/lolbas/Binaries/Jsc/ https://www.phpied.com/make-your-javascript-a-windows-exe/

Input arguments

Name	Type	Default	Description
jscname	path	jsc.exe	Default name of jsc
jscpath	path	C:\Windows\Microsoft.NET\Framework\v4.0.30319	Default location of jsc.exe
filename	path	PathToAtomicsFolder\T1127\src\hello.js	Location of the project file

Attack command

copy "#{filename}" %TEMP%\hello.js
#{jscpath}\#{jscname} %TEMP%\hello.js

Cleanup command

del %TEMP%\hello.js
del %TEMP%\hello.exe

Prerequisite

JavaScript code file must exist on disk at specified location (#{filename})

Check

if (Test-Path "#{filename}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{filename}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127/src/hello.js" -OutFile "#{filename}"

GUID4a439a05-e6ec-461c-92de-cebb5affcb7f

Lolbin Jsc.exe compile javascript to dll

windows

cmd

—

Yes

Use jsc.exe to compile javascript code stored in Library.js and output Library.dll. https://lolbas-project.github.io/lolbas/Binaries/Jsc/ https://www.phpied.com/make-your-javascript-a-windows-exe/

Input arguments

Name	Type	Default	Description
jscname	path	jsc.exe	Default name of jsc
jscpath	path	C:\Windows\Microsoft.NET\Framework\v4.0.30319	Default location of jsc.exe
filename	path	PathToAtomicsFolder\T1127\src\LibHello.js	Location of the project file

Attack command

copy "#{filename}" %TEMP%\LibHello.js
#{jscpath}\#{jscname} /t:library %TEMP%\LibHello.js

Cleanup command

del %TEMP%\LibHello.js
del %TEMP%\LibHello.dll

Prerequisite

JavaScript code file must exist on disk at specified location (#{filename})

Check

if (Test-Path "#{filename}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{filename}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1127/src/LibHello.js" -OutFile "#{filename}"

GUIDb551515e-c899-4104-82be-0bbbbee320e4

Tests from Atomic Red Team (MIT licence) · technique definition

Trusted Developer Utilities Proxy Execution detections T1127

23 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 12%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs