ATT&CK coverage › Technique

Trusted Developer Utilities Proxy Execution T1127

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.

Events covered

6 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon8CreateRemoteThread
Sysmon11FileCreate
Sysmon13RegistryEvent (Value Set)
Security-Auditing4688A new process has been created.
Defender-DeviceProcessEvents9001000Process activity (any)

Authoring guide

Patterns shared across the 22 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (11 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Image17ends_with 17, match 3:\Windows\Microsoft.NET\Framework\, \aspnet_compiler.exe, :\Windows\Microsoft.NET\Framework64\, \ilasm.exe, \sqlps.exe
OriginalFileName10eq 10ilasm.exe, sqlps.exe, jsc.exe, CDB.Exe, \sqltoolsps.exe
CommandLine8match 8target, reference, /dll, /dll, /exe
ParentImage6ends_with 6\sqlps.exe, \sqlagent.exe, \cleanapi.exe, \kavremover.exe, \mftrace.exe
process_name1eq 1MSBuild.exe
Provider_Name1eq 1Microsoft-Windows-Sysmon
FileName1match 1, eq 1csc.exe, vbc.exe, msxsl.exe
TargetFilename1ends_with 1.ps1, .exe, .hta
registry_path1eq 1"*\\SOFTWARE\\Microsoft\\.NETFramework*"
Details1is_not_null 1, eq 10x00000000
registry_value_name1eq 1ETWEnabled

Top indicator values (106 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
Imagematch:\Windows\Microsoft.NET\Framework64\23
Imageends_with\aspnet_compiler.exe23
Imagematch:\Windows\Microsoft.NET\FrameworkArm64\23
Imagematch:\Windows\Microsoft.NET\Framework\23
Imagematch:\Windows\Microsoft.NET\FrameworkArm\23
Provider_NameeqMicrosoft-Windows-Sysmon13
process_nameeqMSBuild.exe1
CommandLinematch/dll1
CommandLinematcht:1
FileNamematchcsc.exe1
FileNameeqilsasm.exe1
CommandLinematch-pe641
CommandLinematchtarget1
CommandLinematch/pe641
CommandLinematch/exe1
CommandLinematch-dll1
CommandLinematchout1
CommandLinematchreference1
FileNamematchmsbuild.exe1
CommandLinematch-exe1

Common exclusions (3 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

FieldKindValueRules excluding
Imagestarts_withC:\\Program Files (x86)\\Microsoft Visual Studio1
InitiatingProcessFileNameeqWDExpress.exe1
InitiatingProcessFileNameeqdevenv.exe1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 19 rules

Elastic 1 rule

Splunk 1 rule

Kusto Query Language 1 rule