System Binary Proxy Execution

What is System Binary Proxy Execution?

“System Binary Proxy Execution is documented as technique T1218 in MITRE ATT&CK® v19.1 under the Defense Evasion tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify System Binary Proxy Execution activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor regsvr32.exe execution with network URLs or scrobj.dll in the command line, which indicates execution of remote COM scriptlets or .sct files that are commonly used to deliver and execute payloads without writing executables to disk.

2. 2

   Alert on mshta.exe executing VBScript or JScript content from remote URLs or from files with unusual extensions, as this technique executes HTML application scripts that can perform arbitrary code execution within a trusted Microsoft-signed process.

3. 3

   Detect rundll32.exe with unusual export function names, loading DLLs from non-system paths, or executing JavaScript through the JavaScript: protocol handler, which are abuse patterns not present in legitimate application usage.

4. 4

   Monitor certutil.exe for download operations using -urlcache, -decode operations on files with non-standard extensions, and other usage patterns inconsistent with its intended certificate utility function.

5. 5

   Track msiexec.exe spawning processes not typically associated with installation operations, particularly command shells and network utilities, as malicious MSI packages frequently include custom actions executing attacker-controlled commands.

Example Alerts

These realistic alert examples show what System Binary Proxy Execution looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect System Binary Proxy Execution?

Detection centers on XDR, SIEM telemetry for the defense evasion phase of the attack. Monitor regsvr32.exe execution with network URLs or scrobj.dll in the command line, which indicates execution of remote COM scriptlets or .sct files that are commonly used to deliver and execute payloads without writing executables to disk. Alert on mshta.exe executing VBScript or JScript content from remote URLs or from files with unusual extensions, as this technique executes HTML application scripts that can perform arbitrary code execution within a trusted Microsoft-signed process.

What does a System Binary Proxy Execution alert look like?

A representative XDR detection is "Regsvr32 Squiblydoo Attack Executing Remote Scriptlet" (high severity): regsvr32.exe executed with /s /n /u /i: flags pointing to a remote URL serving a COM scriptlet file. This technique, known as Squiblydoo, uses the trusted Windows registration server executable to download and execute arbitrary code from the internet. The scriptlet bypasses AppLocker policies that block script execution because it runs through a signed Microsoft binary rather than through a script interpreter directly.

Which tools detect System Binary Proxy Execution, and how can I practice?

System Binary Proxy Execution (T1218) is best surfaced with XDR, SIEM telemetry, which exposes the defense evasion signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.