Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.[1] This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.[2]
System Script Proxy Execution detection strategy DET0466
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Script-Based Proxy Execution via Signed Microsoft Utilities
Enterprise
1 platform
AN1288 · Windows
Execution of Microsoft-signed scripts (e.g., pubprn.vbs, installutil.exe, wscript.exe, cscript.exe) used to proxy execution of untrusted or external binaries. Behavior is detected through command-line process lineage, child process spawning, and unsigned payload execution from signed parent.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Certain signed scripts that can be used to execute other programs may not be necessary within a given environment. Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.
Tests1Executorscommand_prompt 1Need elevation0 of 1Have prerequisites0Have cleanup1Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
manage-bde.wsf Signed Script Command Execution
windows
command_prompt
—
—
Yes
Executes the signed manage-bde.wsf script with options to execute an arbitrary command.
Inputs
Name
Description
Type
Default Value
command_to_execute
A command to execute.
path
%windir%\System32\calc.exe
Attack Commandsrun with command_prompt
set comspec=#{command_to_execute}
cscript %windir%\System32\manage-bde.wsf
Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.
The following analytic detects the execution of Syncappvpublishingserver.vbs via wscript.exe or cscript.exe, which may indicate an attempt to download remote files or perform privilege escalation. (...)