{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","url":"https://attack.mitre.org/techniques/T1127","tactics":["stealth","execution"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0172","stix_id":"x-mitre-detection-strategy--f47cb8dc-2120-4541-9306-95053218ba8a","name":"Behavior-chain, platform-aware detection strategy for T1127 Trusted Developer Utilities Proxy Execution (Windows)","url":"https://attack.mitre.org/detectionstrategies/DET0172","analytics":[{"id":"AN0488","stix_id":"x-mitre-analytic--d69c9d97-17d6-4dad-a4d4-ec41e7fb34fb","name":"Analytic 0488","description":"A trusted/signed developer utility (parent) is executed in a non-developer context and (a) spawns suspicious children (e.g., powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, wscript.exe), (b) loads unsigned/user-writable DLLs, (c) writes and then runs a new PE from user-writable paths, and/or (d) immediately makes outbound network connections.","url":"https://attack.mitre.org/detectionstrategies/DET0172#AN0488","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:AppLocker","channel":"AppLocker audit/blocks showing developer utilities executing scripts/binaries outside policy","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"wineventlog-applocker"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation window between developer utility execution, payload write, and network egress (e.g., 0–30 minutes)."},{"field":"AllowedUtilitiesList","description":"Org-specific list of dev utilities legitimately used on build/dev hosts to suppress noise."},{"field":"DeveloperHosts","description":"List of known developer/build systems where these tools are expected; raise severity off-host."},{"field":"SuspiciousChildList","description":"Child processes considered high-risk when spawned by dev utilities (powershell.exe, rundll32.exe, regsvr32.exe, cmd.exe, wscript.exe, mshta.exe)."},{"field":"RarePathRegex","description":"Regex of user-writable or atypical paths (e.g., %TEMP%, %APPDATA%, recycle bin, public profile) for payload drops."},{"field":"UnsignedOrInvalidSignatureOnly","description":"Toggle to alert only when child/payload is unsigned or signature invalid to reduce noise."},{"field":"ParentProcessAllowList","description":"Known orchestrators (e.g., CI/CD agents) that often run these utilities legitimately."},{"field":"NetworkReputationThreshold","description":"Heuristic for rare/unknown destination (no DNS reputation, new domain, geo outside region)."}],"live":true,"detection_strategies":["DET0172"],"techniques":["T1127"]}],"live":true,"version":"1.0","techniques":["T1127"]}],"sigma_rules":[{"id":"0152550d-3a26-4efd-9f0e-54a0b28ae2f3","title":"Detection of PowerShell Execution via Sqlps.exe","author":"Agro (@agro_sev) oscd.community","status":"test","level":"medium","date":"2020-10-10","modified":"2022-12-09","description":"This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.\nScript blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.\n","references":["https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/","https://twitter.com/bryon_/status/975835709587075072"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml","techniques":["T1059.001","T1127"],"cves":[]},{"id":"18749301-f1c5-4efc-a4c3-276ff1f5b6f8","title":"Use of VSIISExeLauncher.exe","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-09","modified":null,"description":"The \"VSIISExeLauncher.exe\" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/VSIISExeLauncher/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml","techniques":["T1127"],"cves":[]},{"id":"3d48c9d3-1aa6-418d-98d3-8fd3c01a564e","title":"Potential Mftrace.EXE Abuse","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-09","modified":"2023-08-03","description":"Detects child processes of the \"Trace log generation tool for Media Foundation Tools\" (Mftrace.exe) which can abused to execute arbitrary binaries.","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_mftrace_child_process.yml","techniques":["T1127"],"cves":[]},{"id":"419dbf2b-8a9b-4bea-bf99-7544b050ec8d","title":"Microsoft Workflow Compiler Execution","author":"Nik Seetharaman, frack113","status":"test","level":"medium","date":"2019-01-16","modified":"2023-02-03","description":"Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.\n","references":["https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127","attack.t1218","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution.yml","techniques":["T1127","T1218"],"cves":[]},{"id":"49be8799-7b4d-4fda-ad23-cafbefdebbc5","title":"Use of Wfc.exe","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","status":"test","level":"medium","date":"2022-06-01","modified":null,"description":"The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wfc/","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_wfc.yml","techniques":["T1127"],"cves":[]},{"id":"4eddc365-79b4-43ff-a9d7-99422dc34b93","title":"Use of Remote.exe","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","status":"test","level":"medium","date":"2022-06-02","modified":null,"description":"Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.","references":["https://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_remote.yml","techniques":["T1127"],"cves":[]},{"id":"52788a70-f1da-40dd-8fbd-73b5865d6568","title":"JScript Compiler Execution","author":"frack113","status":"test","level":"low","date":"2022-05-02","modified":"2024-04-24","description":"Detects the execution of the \"jsc.exe\" (JScript Compiler).\nAttacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Jsc/","https://www.phpied.com/make-your-javascript-a-windows-exe/","https://twitter.com/DissectMalware/status/998797808907046913"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_jsc_execution.yml","techniques":["T1127"],"cves":[]},{"id":"6640f31c-01ad-49b5-beb5-83498a5cd8bd","title":"Potential Arbitrary Code Execution Via Node.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-09","modified":"2023-02-03","description":"Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc","references":["http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html","https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return","https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/","https://nodejs.org/api/cli.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_node_abuse.yml","techniques":["T1127"],"cves":[]},{"id":"850d55f9-6eeb-4492-ad69-a72338f65ba4","title":"C# IL Code Compilation Via Ilasm.EXE","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-05-07","modified":"2022-05-16","description":"Detects the use of \"Ilasm.EXE\" in order to compile C# intermediate (IL) code to EXE or DLL.","references":["https://lolbas-project.github.io/lolbas/Binaries/Ilasm/","https://www.echotrail.io/insights/search/ilasm.exe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_ilasm_il_code_compilation.yml","techniques":["T1127"],"cves":[]},{"id":"9ccba514-7cb6-4c5c-b377-700758f2f120","title":"Suspicious Child Process of AspNetCompiler","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-14","modified":null,"description":"Detects potentially suspicious child processes of \"aspnet_compiler.exe\".","references":["https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/","https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_child_process.yml","techniques":["T1127"],"cves":[]},{"id":"9f50fe98-fe5c-4a2d-86c7-fad7f63ed622","title":"Potentially Suspicious ASP.NET Compilation Via AspNetCompiler","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-14","modified":"2025-02-24","description":"Detects execution of \"aspnet_compiler.exe\" with potentially suspicious paths for compilation.","references":["https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/","https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml","techniques":["T1127"],"cves":[]},{"id":"a01b8329-5953-4f73-ae2d-aa01e1f35f00","title":"AspNetCompiler Execution","author":"frack113","status":"test","level":"medium","date":"2021-11-24","modified":"2025-02-24","description":"Detects execution of \"aspnet_compiler.exe\" which can be abused to compile and execute C# code.","references":["https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/","https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml","techniques":["T1127"],"cves":[]},{"id":"a746c9b8-a2fb-4ee5-a428-92bee9e99060","title":"SQL Client Tools PowerShell Session Detection","author":"Agro (@agro_sev) oscd.communitly","status":"test","level":"medium","date":"2020-10-13","modified":"2022-02-25","description":"This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.\nScript blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.\n","references":["https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OtherMSBinaries/Sqltoolsps.yml","https://twitter.com/pabraeken/status/993298228840992768"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml","techniques":["T1059.001","T1127"],"cves":[]},{"id":"a9e416a8-e613-4f8b-88b8-a7d1d1af2f61","title":"Suspicious Use of CSharp Interactive Console","author":"Michael R. (@nahamike01)","status":"test","level":"high","date":"2020-03-08","modified":"2022-07-14","description":"Detects the execution of CSharp interactive console by PowerShell","references":["https://redcanary.com/blog/detecting-attacks-leveraging-the-net-framework/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml","techniques":["T1127"],"cves":[]},{"id":"b27077d6-23e6-45d2-81a0-e2b356eea5fd","title":"Use of TTDInject.exe","author":"frack113","status":"test","level":"medium","date":"2022-05-16","modified":null,"description":"Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)","references":["https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml","techniques":["T1127"],"cves":[]},{"id":"b5c7395f-e501-4a08-94d4-57fe7a9da9d2","title":"Potential Binary Proxy Execution Via Cdb.EXE","author":"Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-10-26","modified":"2024-04-22","description":"Detects usage of \"cdb.exe\" to launch arbitrary processes or commands from a debugger script file","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/","https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html","https://twitter.com/nas_bench/status/1534957360032120833"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1106","attack.t1218","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml","techniques":["T1106","T1218","T1127"],"cves":[]},{"id":"c15e99a3-c474-48ab-b9a7-84549a7a9d16","title":"Remote Thread Creation Ttdinject.exe Proxy","author":"frack113","status":"test","level":"high","date":"2022-05-16","modified":"2022-06-02","description":"Detects a remote thread creation of Ttdinject.exe used as proxy","references":["https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml","techniques":["T1127"],"cves":[]},{"id":"d047726b-c71c-4048-a99b-2e2f50dc107d","title":"Kavremover Dropped Binary LOLBIN Usage","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-11-01","modified":null,"description":"Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.","references":["https://nasbench.medium.com/lolbined-using-kaspersky-endpoint-security-kes-installer-to-execute-arbitrary-commands-1c999f1b7fea"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_kavremover_uncommon_execution.yml","techniques":["T1127"],"cves":[]},{"id":"df1f26d3-bea7-4700-9ea2-ad3e990cf90e","title":"Node Process Executions","author":"Max Altgelt (Nextron Systems)","status":"test","level":"medium","date":"2022-04-06","modified":null,"description":"Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud","references":["https://twitter.com/mttaggart/status/1511804863293784064"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_node_adobe_creative_cloud_abuse.yml","techniques":["T1127","T1059.007"],"cves":[]},{"id":"e890acee-d488-420e-8f20-d9b19b3c3d43","title":"Suspicious File Created by ArcSOC.exe","author":"Micah Babinski","status":"experimental","level":"high","date":"2025-11-25","modified":null,"description":"Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS\nserver, creates a file with suspicious file type, indicating that it may be an executable, script file,\nor otherwise unusual.\n","references":["https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/","https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.command-and-control","attack.persistence","attack.initial-access","attack.execution","attack.stealth","attack.t1127","attack.t1105","attack.t1133"],"path":"rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml","techniques":["T1127","T1105","T1133"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}