Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1218

System Binary Proxy Execution

Stealth 263 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Unusual Network Activity from a Windows System Binary production 2026-10-19
sigma Legitimate Application Writing Files In Uncommon Location experimental 2026-10-14
elastic Suspicious Windows Command Shell Arguments production 2026-10-09
elastic Script Execution via Microsoft HTML Application production 2026-10-09
elastic Suspicious Microsoft Diagnostics Wizard Execution production 2026-10-09
elastic MsiExec Service Child Process With Network Connection production 2026-10-09
splunk Windows Proxy Execution of .NET Utilities via Scripts production 2026-10-09
elastic Suspicious Microsoft HTML Application Child Process production 2026-10-09
elastic Network Activity to a Suspicious Top Level Domain production 2026-10-09
elastic Potential Proxy Execution via Systemd-run production 2026-10-09
elastic Shared Object Load via LoLBin production 2026-10-09
elastic Suspicious SolarWinds Web Help Desk Java Module Load or Child Process production 2026-10-09
elastic Persistence via a Windows Installer production 2026-10-05
elastic Potential FileFix Command via Windows Explorer Address Bar production 2026-10-05
elastic Potential ClickFix Command via Windows Run Dialog production 2026-10-05
splunk Windows System Script Proxy Execution Syncappvpublishingserver production 2026-10-02
elastic Potential Execution via FileFix Phishing Attack production 2026-09-28
elastic Execution via OpenClaw Agent production 2026-09-25
splunk Cisco NVM - Suspicious Network Connection From Process With No Args production 2026-09-22
splunk Windows AppLocker Privilege Escalation via Unauthorized Bypass production 2026-09-22
splunk Windows AppLocker Block Events production 2026-09-22
elastic Suspicious ScreenConnect Client Child Process production 2026-09-18
elastic Potential Protocol Tunneling via Yuze production 2026-09-18
elastic RMM Software Installation from an Internet-Originated MSI production 2026-09-18
elastic RMM Software Installation from a Commonly Abused Web Service production 2026-09-18
elastic Potential Command and Control via Internet Explorer production 2026-09-18
elastic Potential File Transfer via Certreq production 2026-09-18
elastic Potential Privilege Escalation via SUID/SGID Proxy Execution production 2026-09-18
elastic Suspicious Command Execution via Busybox Proxy production 2026-09-18
elastic Potentially Suspicious Process Started via tmux or screen production 2026-09-18
elastic Dynamic Linker (ld.so) Creation production 2026-09-18
elastic Curl or Wget Egress Network Connection via LoLBin production 2026-09-18
elastic Proxy Shell Execution via Busybox production 2026-09-18
elastic Shell Execution via Elastic Endpoint production 2026-09-18
elastic User Detected with Suspicious Windows Process(es) production 2026-09-18
elastic Parent Process Detected with Suspicious Windows Process(es) production 2026-09-18
elastic Host Detected with Suspicious Windows Process(es) production 2026-09-18
elastic Unusual Process Spawned by a User production 2026-09-18
elastic Unusual Process Spawned by a Parent Process production 2026-09-18
elastic Unusual Process Spawned by a Host production 2026-09-18
elastic Execution via GitHub Actions Runner production 2026-09-18
elastic UAC Bypass via Windows Firewall Snap-In Hijack production 2026-09-18
elastic UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer production 2026-09-18
elastic Service Control Spawned via Script Interpreter production 2026-09-18
elastic Potential Escalation via Vulnerable MSI Repair production 2026-09-18
elastic Execution of Persistent Suspicious Program production 2026-09-18
elastic Incoming DCOM Lateral Movement with MMC production 2026-09-18
elastic Incoming DCOM Lateral Movement via MSHTA production 2026-09-18
elastic Suspicious Explorer Child Process production 2026-09-18
elastic Potential CVE-2025-33053 Exploitation production 2026-09-18
elastic Windows Server Update Service Spawning Suspicious Processes production 2026-09-18
elastic Suspicious MS Outlook Child Process production 2026-09-18
elastic Suspicious MS Office Child Process production 2026-09-18
elastic Suspicious Execution from VS Code Extension production 2026-09-18
elastic Suspicious JetBrains TeamCity Child Process production 2026-09-18
elastic Potential Remote File Execution via MSIEXEC production 2026-09-18
elastic Execution of a Downloaded Windows Script production 2026-09-18
elastic Potential Fake CAPTCHA Phishing Attack production 2026-09-18
elastic Microsoft Management Console File from Unusual Path production 2026-09-18
elastic Process Activity via Compiled HTML File production 2026-09-18
elastic Suspicious PDF Reader Child Process production 2026-09-18
elastic Network Connection via Registration Utility production 2026-09-18
elastic Command and Scripting Interpreter via Windows Scripts production 2026-09-18
elastic Unusual Execution via Microsoft Common Console File production 2026-09-18
elastic Network Connection via Compiled HTML File production 2026-09-18
elastic Execution from Unusual Directory - Command Line production 2026-09-18
elastic Delayed Execution via Ping production 2026-09-18
elastic Command Shell Activity Started via RunDLL32 production 2026-09-18
elastic Execution of COM object via Xwizard production 2026-09-18
elastic Suspicious Child Process via Azure VM CustomScript Extension production 2026-09-18
elastic Signed Proxy Execution via MS Work Folders production 2026-09-18
elastic Unusual Process Network Connection production 2026-09-18
elastic Unusual Network Connection via RunDLL32 production 2026-09-18
elastic Unusual Network Connection via DllHost production 2026-09-18
elastic Suspicious WMIC XSL Script Execution production 2026-09-18
elastic Suspicious Script Object Execution production 2026-09-18
elastic Suspicious Managed Code Hosting Process production 2026-09-18
elastic Suspicious Execution from a Mounted Device production 2026-09-18
elastic Unusual Child Processes of RunDLL32 production 2026-09-18
elastic Potential Remote Install via MsiExec production 2026-09-18
elastic Mshta Making Network Connections production 2026-09-18
elastic Network Connection via Signed Binary production 2026-09-18
elastic Execution via Windows Command Debugging Utility production 2026-09-18
elastic InstallUtil Process Making Network Connections production 2026-09-18
elastic Microsoft Build Engine Started by a Script Process production 2026-09-18
elastic ImageLoad via Windows Update Auto Update Client production 2026-09-18
elastic Control Panel Process with Unusual Arguments production 2026-09-18
elastic Suspicious .NET Code Compilation production 2026-09-18
elastic Potential Credential Access via Renamed COM+ Services DLL production 2026-09-18
elastic Potential Local NTLM Relay via HTTP production 2026-09-18
elastic Rare Connection to WebDAV Target production 2026-09-18
elastic Potential Credential Access via Windows Utilities production 2026-09-18
elastic Suspicious Shell Execution via Velociraptor production 2026-09-18
splunk LOLBAS Network Connection On Uncommon Port production 2026-08-24
splunk LOLBAS Rare Network Connection production 2026-08-24
sigma Potentially Suspicious Mofcomp Execution test 2026-08-06
splunk Windows Rasautou DLL Execution production 2026-05-13
splunk Windows Execute Arbitrary Commands with MSDT production 2026-05-13
splunk Windows Diskshadow Proxy Execution production 2026-05-13
splunk Windows BitLockerToGo with Network Activity production 2026-05-13
splunk Windows BitLockerToGo Process Execution production 2026-05-13
splunk Windows AppLocker Rare Application Launch Detection production 2026-05-13
splunk Windows AppLocker Execution from Uncommon Locations production 2026-05-13
splunk Windows Advanced Installer MSIX with AI_STUBS Execution production 2026-05-13
splunk Windows MSC EvilTwin Directory Path Manipulation production 2026-05-13
sigma Legitimate Application Dropped Script test 2026-05-11
sigma Legitimate Application Dropped Executable test 2026-05-11
sigma Suspicious WSL InstallLocation Registry Key Modification Via CommandLine experimental 2026-05-05
sigma Suspicious WSL Binary Masquerading experimental 2026-05-05
sigma Potential WSL InstallLocation Registry Key Modification experimental 2026-05-05
sigma Suspicious WSL Binary Hijack via Proxy Execution experimental 2026-05-05
sigma Potential WSL Binary Modification from Installed Location experimental 2026-05-05
sigma Sensitive File Dump Via Print.EXE test 2026-04-28
sigma Windows MSIX Package Support Framework AI_STUBS Execution experimental 2025-11-03
sigma Wlrmdr.EXE Uncommon Argument Or Child Process experimental 2025-10-31
sigma MSDT Execution Via Answer File test 2025-10-29
sigma Suspicious Speech Runtime Binary Child Process experimental 2025-10-23
sigma Winrs Local Command Execution experimental 2025-10-22
sigma Potential Devil Bait Malware Reconnaissance test 2025-10-19
sigma BaaUpdate.exe Suspicious DLL Load experimental 2025-10-18
sigma Suspicious BitLocker Access Agent Update Utility Execution experimental 2025-10-18
sigma Program Executed Using Proxy/Local Command Via SSH.EXE test 2025-10-16
sigma Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE test 2025-10-08
sigma Verclsid.exe Runs COM Object test 2025-10-07
sigma Process Proxy Execution Via Squirrel.EXE test 2025-10-07
sigma Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access experimental 2025-06-13
sigma Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load experimental 2025-06-13
sigma Potential Exploitation of RCE Vulnerability CVE-2025-33053 experimental 2025-06-13
sigma PowerShell MSI Install via WindowsInstaller COM From Remote Location experimental 2025-06-05
sigma Potential Binary Impersonating Sysinternals Tools test 2025-04-12
sigma AddinUtil.EXE Execution From Uncommon Directory test 2025-02-24
sigma Potentially Suspicious Child Processes Spawned by ConHost experimental 2025-02-05
sigma Scheduled Task Creation with Curl and PowerShell Execution Combo experimental 2025-02-05
sigma Renamed ZOHO Dctask64 Execution test 2025-01-22
sigma MpiExec Lolbin test 2024-11-23
sigma Potential Compromised 3CXDesktopApp Execution test 2024-11-23
sigma Potentially Suspicious Cabinet File Expansion test 2024-11-13
sigma Potential DLL Sideloading Activity Via ExtExport.EXE test 2024-08-26
sigma Sdiagnhost Calling Suspicious Child Process test 2024-08-23
sigma Hidden Flag Set On File/Directory Via Chflags - MacOS test 2024-08-21
sigma COM Object Execution via Xwizard.EXE test 2024-08-15
sigma Suspicious AgentExecutor PowerShell Execution test 2024-08-07
sigma AgentExecutor PowerShell Execution test 2024-08-07
sigma Dllhost.EXE Initiated Network Connection To Non-Local IP Address test 2024-07-16
sigma Network Connection Initiated By AddinUtil.EXE test 2024-07-16
sigma BitLockerTogo.EXE Execution test 2024-07-11
sigma Uncommon Link.EXE Parent Process test 2024-06-27
sigma Uncommon Child Process Of Setres.EXE test 2024-06-26
sigma Potential Proxy Execution Via Explorer.EXE From Shell Process test 2024-06-21
sigma Lolbin Unregmp2.exe Use As Proxy test 2024-06-04
sigma Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location test 2024-06-04
sigma Potential Application Whitelisting Bypass via Dnx.EXE test 2024-04-24
sigma Potential Arbitrary File Download Via Cmdl32.EXE test 2024-04-22
sigma Potential Binary Proxy Execution Via Cdb.EXE test 2024-04-22
sigma Uncommon Child Process Of Defaultpack.EXE test 2024-04-22
sigma Potentially Suspicious CMD Shell Output Redirect test 2024-03-19
sigma Diskshadow Script Mode Execution test 2024-03-13
sigma Microsoft Sync Center Suspicious Network Connections test 2024-03-12
sigma Potentially Suspicious Wuauclt Network Connection test 2024-03-12
sigma Uncommon Assistive Technology Applications Execution Via AtBroker.EXE test 2024-03-06
sigma Insensitive Subfolder Search Via Findstr.EXE test 2024-03-05
sigma Curl Download And Execute Combination test 2024-03-05
sigma DLL Loaded via CertOC.EXE test 2024-03-05
sigma Suspicious DLL Loaded via CertOC.EXE test 2024-03-05
sigma Diskshadow Script Mode - Uncommon Script Extension Execution test 2024-03-05
sigma Remote File Download Via Findstr.EXE test 2024-03-05
sigma Diskshadow Script Mode - Execution From Potential Suspicious Location test 2024-03-05
sigma Self Extraction Directive File Created In Potentially Suspicious Location test 2024-02-05
sigma New Self Extracting Package Created Via IExpress.EXE test 2024-02-05
sigma Potentially Suspicious Self Extraction Directive File Created test 2024-02-05
sigma Binary Proxy Execution Via Dotnet-Trace.EXE test 2024-01-02
sigma Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE test 2024-01-02
sigma Proxy Execution Via Wuauclt.EXE test 2023-11-11
sigma XBAP Execution From Uncommon Locations Via PresentationHost.EXE test 2023-11-09
sigma Uncommon Child Process Of Appvlp.EXE test 2023-11-09
sigma Arbitrary File Download Via MSOHTMED.EXE test 2023-11-09
sigma Arbitrary File Download Via IMEWDBLD.EXE test 2023-11-09
sigma File Download Via InstallUtil.EXE test 2023-11-09
sigma Arbitrary File Download Via PresentationHost.EXE test 2023-11-09
sigma Arbitrary File Download Via MSEDGE_PROXY.EXE test 2023-11-09
sigma File Download Using ProtocolHandler.exe test 2023-11-09
sigma File Download Via Windows Defender MpCmpRun.EXE test 2023-11-09
sigma Arbitrary File Download Via Squirrel.EXE test 2023-11-09
sigma Potential File Download Via MS-AppInstaller Protocol Handler test 2023-11-09
sigma Potentially Suspicious Child Process Of VsCode test 2023-10-25
sigma Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly test 2023-10-17
sigma Rundll32.EXE Calling DllRegisterServer Export Function Explicitly test 2023-10-17
sigma Uncommon Child Process Of AddinUtil.EXE test 2023-09-18
sigma Uncommon AddinUtil.EXE CommandLine Execution test 2023-09-18
sigma Suspicious AddinUtil.EXE CommandLine Execution test 2023-09-18
sigma Diskshadow Child Process Spawned test 2023-09-15
sigma Potentially Suspicious Child Process Of DiskShadow.EXE test 2023-09-15
sigma Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG test 2023-08-17
sigma Execution DLL of Choice Using WAB.EXE test 2023-08-17
sigma Suspicious Child Process Of BgInfo.EXE test 2023-08-16
sigma Uncommon Child Process Of BgInfo.EXE test 2023-08-16
sigma WSL Child Process Anomaly test 2023-08-15
sigma Potential Provlaunch.EXE Binary Proxy Execution Abuse test 2023-08-08
sigma Suspicious Provlaunch.EXE Child Process test 2023-08-08
sigma Potential Provisioning Registry Key Abuse For Binary Proxy Execution test 2023-08-08
sigma Potential Binary Proxy Execution Via VSDiagnostics.EXE test 2023-08-03
sigma Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution test 2023-08-03
sigma Gpscript Execution test 2023-06-14
sigma Windows Shell/Scripting Processes Spawning Suspicious Programs test 2023-05-23
sigma Potential RemoteFXvGPUDisablement.EXE Abuse test 2023-05-09
sigma Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module test 2023-05-09
sigma Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock test 2023-05-09
sigma RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses test 2023-05-09
sigma HTML Help HH.EXE Suspicious Child Process test 2023-04-12
sigma Arbitrary Command Execution Using WSL test 2023-04-12
sigma Suspicious HH.EXE Execution test 2023-04-12
sigma Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution test 2023-04-11
sigma Visual Studio NodejsTools PressAnyKey Renamed Execution test 2023-04-11
sigma Arbitrary MSI Download Via Devinit.EXE test 2023-04-06
sigma Potential Suspicious Child Process Of 3CXDesktopApp test 2023-03-29
sigma Potential Compromised 3CXDesktopApp Update Activity test 2023-03-29
sigma Import LDAP Data Interchange Format File Via Ldifde.EXE test 2023-03-14
sigma Process Memory Dump Via Dotnet-Dump test 2023-03-14
sigma Suspicious DotNET CLR Usage Log Artifact test 2023-02-23
sigma Potential NTLM Coercion Via Certutil.EXE test 2023-02-14
sigma Arbitrary File Download Via MSPUB.EXE test 2023-02-08
sigma Suspicious MSDT Parent Process test 2023-02-06
sigma Potential Password Spraying Attempt Using Dsacls.EXE test 2023-02-04
sigma Potentially Over Permissive Permissions Granted Using Dsacls.EXE test 2023-02-04
sigma Renamed MegaSync Execution test 2023-02-03
sigma Microsoft Workflow Compiler Execution test 2023-02-03
sigma Atbroker Registry Change test 2023-01-19
sigma Potential DLL Sideloading Using Coregen.exe test 2022-12-31
sigma Lolbin Runexehelper Use As Proxy test 2022-12-29
sigma Suspicious ZipExec Execution test 2022-12-25
sigma Execution via WorkFolders.exe test 2022-12-25
sigma SyncAppvPublishingServer Execution to Bypass Powershell Restriction test 2022-12-25
sigma Execution via stordiag.exe test 2022-12-25
sigma Time Travel Debugging Utility Usage - Image test 2022-12-02
sigma SyncAppvPublishingServer Bypass Powershell Restriction - PS Module test 2022-12-02
sigma Use Of The SFTP.EXE Binary As A LOLBIN test 2022-11-10
sigma Suspicious Vsls-Agent Command With AgentExtensionPath Load test 2022-10-30
sigma MSI Installation From Web test 2022-10-23
sigma Malicious PE Execution by Microsoft Visual Studio Debugger test 2022-10-09
sigma Time Travel Debugging Utility Usage test 2022-10-09
sigma InfDefaultInstall.exe .inf Execution test 2022-10-09
sigma SyncAppvPublishingServer Execute Arbitrary PowerShell Code test 2022-10-04
sigma Legitimate Application Dropped Archive test 2022-08-21
sigma DeviceCredentialDeployment Execution test 2022-08-19
sigma REGISTER_APP.VBS Proxy Execution test 2022-08-19
sigma Suspicious Csi.exe Usage test 2022-07-11
sigma Potential Register_App.Vbs LOLScript Abuse test 2022-07-07
sigma Abusing Print Executable test 2022-07-07
sigma Use of Scriptrunner.exe test 2022-07-01
sigma SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code test 2022-06-22
sigma Execute Pcwrun.EXE To Leverage Follina test 2022-06-13
sigma New Capture Session Launched Via DXCap.EXE test 2022-06-09
sigma Created Files by Microsoft Sync Center test 2022-06-02
sigma Use of VisualUiaVerifyNative.exe test 2022-06-01
sigma Ie4uinit Lolbin Use From Invalid Path test 2022-05-16
sigma Execute Files with Msdeploy.exe test 2021-11-27
sigma OpenWith.exe Executes Specified Binary test 2021-11-27
sigma Malicious Windows Script Components File Execution by TAEF Detection test 2021-11-27
sigma Indirect Command Execution By Program Compatibility Wizard test 2021-11-27
sigma Devtoolslauncher.exe Executes Specified Binary test 2021-11-27
elastic Execution via Regsvcs/Regasm deprecated 2021-03-17
elastic Network Connection via Mshta deprecated 2020-10-30
sigma DLL Execution via Rasautou.exe test 2020-10-09