Application control and signature checks trust Microsoft-signed binaries, so attackers make those binaries run their code for them: rundll32 loads the DLL, mshta runs the script, msiexec installs the package, and the process tree shows only trusted names. MITRE ATT&CK T1218 System Binary Proxy Execution covers proxying execution of malicious content through signed or otherwise trusted binaries to bypass process and signature-based defences. In ATT&CK v20 it sits in the Stealth tactic (TA0005) and has 14 sub-techniques, almost all Windows utilities, plus Electron applications across platforms; Rundll32 (T1218.011) alone is recorded for 67 malware families and 26 groups. This guide summarises each proxy binary from the defender's side, then focuses on argument, module-load and network analytics, and on the application control, attack surface reduction and feature removal settings that close these paths. It is for detection engineers, SOC analysts and endpoint owners, and contains no execution examples. For the broader living-off-the-land picture, see the Living off the Land Guide.
Key takeaways
- The binary is trusted, its behaviour is not. Detection keys on what the binary is asked to do: unusual arguments, DLLs or scripts from user-writable or remote locations, and network connections the binary should never make.
- Block what you do not need. Microsoft's recommended App Control block list includes
mshta.exeand several other proxy-capable tools, and its sample policy also denies InstallUtil; most organisations need none of them on user devices. - Constrain what you cannot block. rundll32, regsvr32 and msiexec are part of Windows, so restrict their network access, the paths they may load from and their parents.
- Watch module loads. ATT&CK's analytics for rundll32, regsvr32 and msiexec use Sysmon event 7 (image loaded) as well as process creation, because the payload is the DLL, not the process.
- Renaming does not help an attacker if you key on metadata. Use OriginalFileName so a copied and renamed mshta or rundll32 is still caught. See the T1036 Masquerading Defensive Guide.
How the attack works
ATT&CK explains that binaries "signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation", and that several default Microsoft-signed binaries can proxy execution of other files or commands. On Linux, utilities such as split can play the same role. The v20 sub-techniques, grouped by what they proxy:
| Proxy type | Sub-techniques (v20) | What the binary normally does | Abuse pattern defenders look for |
|---|---|---|---|
| DLL loaders | .011 Rundll32; .010 Regsvr32; .002 Control Panel; .008 Odbcconf | Run DLL exports, register COM servers, open Control Panel items, configure ODBC | DLLs or .cpl files from user-writable or remote paths; scriptlets; script protocol arguments |
| Script and HTML hosts | .005 Mshta; .001 Compiled HTML File (hh.exe); .014 MMC | Run HTML applications, help files and management consoles | HTA or script content from the internet or email; CHM files from downloads; unexpected .msc files |
| Installers and profile tools | .007 Msiexec; .003 CMSTP | Install MSI packages and Connection Manager profiles | Packages from URLs or UNC paths; INF files from user folders; msiexec loading DLLs |
| .NET utilities | .004 InstallUtil; .009 Regsvcs/Regasm | Install or register .NET components | Execution from the .NET directories against assemblies in user paths |
| Injection and verification hosts | .013 Mavinject; .012 Verclsid | App-V injection; shell extension verification | Any use outside App-V environments; verclsid with unusual CLSIDs |
| Trusted applications | .015 Electron Applications | Run desktop apps built on Chromium and Node.js | Electron apps launched with debugging or unusual flags, or loading modified application files |
Closely related techniques sit outside T1218: T1059 Command and Scripting Interpreter for script engines themselves, T1216 System Script Proxy Execution for signed scripts, T1127 Trusted Developer Utilities Proxy Execution for tools such as MSBuild, and T1220 XSL Script Processing.
Where it shows up
- Phishing chains: ATT&CK records Lazarus Group using mshta to execute HTML pages downloaded by initial access documents, Earth Lusca loading an HTA script from a malicious LNK file, and many groups (FIN7, Kimsuky, MuddyWater, APT29) using mshta for script execution. See the Malicious LNK Files Guide.
- Loaders and post-exploitation frameworks: APT41 used rundll32 to execute a loader and Storm-0501 launched Cobalt Strike Beacon files with regsvr32. See the Malware Loaders and Droppers Guide.
- Download-and-run installers: TA505, Rancor and ZIRCONIUM used msiexec to download and execute malicious installer files, which overlaps with T1105 Ingress Tool Transfer.
- Application control bypass: ATT&CK records APT19 using regsvr32 specifically to bypass application control.
- Supply chain: in the 3CX supply chain attack, ATT&CK records components delivered in an MSI package and malicious libraries executed under the official Electron application.
- Renamed copies: APT38 used a renamed mshta to execute malicious HTML files, combining T1218 with masquerading.
Impact
Proxy execution lets an attacker run arbitrary code while application control, reputation services and analysts see a signed Microsoft process. It undermines allowlisting programmes that permit everything under C:\Windows, inflates investigation time because the parent chain looks normal, and in the case of Mavinject and some loaders can place code inside other trusted processes (see the T1055 Process Injection Defensive Guide).
Detection
DET0081 covers the parent technique, with one strategy per sub-technique. The analytics share three signals: arguments, loaded modules and network activity.
| Binary | ATT&CK strategy | Telemetry | Indicators of abuse |
|---|---|---|---|
| rundll32.exe | DET0475 | Sysmon 1, 7, 11, 3 and 22 | Atypical arguments (script protocols, mshtml, .cpl), Control_RunDLL or RunHTMLApplication, DLLs not normally loaded, DLLs from user or network paths, outbound connections |
| regsvr32.exe | DET0282 | Security 4688, Sysmon 7, 3 and 22 | Scriptlets or DLLs from temporary directories or remote URLs, network connections, unusual parents such as Office or script hosts |
| mshta.exe | DET0506 | Security 4688, Sysmon 3, 22 and 11 | Remote or local HTA or script arguments followed by file creation, network retrieval or child processes |
| msiexec.exe | DET0158 | Security 4688, Sysmon 7, 3 and 22 | Remote MSI packages, UNC paths, URLs or DLL arguments, with module loads and connections to unseen destinations |
| hh.exe, control.exe, cmstp.exe, mmc.exe | DET0342, DET0194, DET0328, DET0222 | Process creation, file creation, module loads | CHM, CPL, INF or MSC files from downloads, email or temporary folders; child processes |
| InstallUtil, Regsvcs, Regasm, Odbcconf | DET0138, DET0361, DET0486 | Process creation and module loads | Any execution on endpoints without .NET development or ODBC administration needs |
| mavinject.exe, verclsid.exe | DET0433, DET0042 | Process creation, Sysmon 8 and 10 for injection | Use outside App-V; injection into other processes |
Tuning advice
- Network is the strongest single signal: mshta, regsvr32, msiexec with a URL and rundll32 rarely need to connect to the internet on user devices. Alert on any external connection from them.
- Parent context matters: Office applications, browsers, script hosts and archive tools spawning proxy binaries are high-risk; software deployment agents spawning msiexec are normal.
- Baseline per binary: record the normal argument patterns and loaded DLL paths for rundll32 on your gold image; Windows itself uses rundll32 heavily, so allowlist known exports and paths rather than the binary.
- Use metadata, not names: match on OriginalFileName so renamed copies are included. See the Sigma Rules Guide for portable rules.
Prevention and hardening
| Control | Setting or approach | Sub-techniques addressed |
|---|---|---|
| App Control recommended block rules | Merge Microsoft's recommended block rules (including mshta.exe, wmic.exe, cscript.exe, wscript.exe, msbuild.exe, and InstallUtil in the sample XML) into your base policy with Merge-CIPolicy, audit first. See the Application Allowlisting Guide | .005, .004 and related proxy tools (ATT&CK M1038) |
| Do not trust whole directories | Avoid allow rules for all of C:\Windows without the block list; prefer publisher and OriginalFileName rules | All |
| Attack surface reduction rules | "Block all Office applications from creating child processes" (d4f940ab-401b-4efc-aadc-ad5f3c50688a); "Block execution of potentially obfuscated scripts" (5beb7efe-fd9a-4556-801d-275e5ffc04cc); "Block JavaScript or VBScript from launching downloaded executable content" (d3e037e1-3eb8-44c8-a917-57927947596d); "Block Win32 API calls from Office macros" (92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b) | Phishing chains into .005, .010, .011 (M1040 style behaviour prevention) |
| Remove or disable features | Remove the HTA file association or block mshta where unused; restrict CMSTP, Mavinject and Odbcconf; disable App-V where not used | .003, .005, .008, .013 (M1042) |
| Outbound network restrictions | Host firewall rules blocking internet access for proxy binaries that should never connect out; proxy enforcement for the rest | .005, .007, .010, .011 (M1037) |
| Restrict web-based content | Block HTA, CHM, CPL, MSC and INF attachments and downloads at mail and web gateways | .001, .002, .003, .005, .014 (M1021) |
| Exploit protection and privilege | Exploit protection settings and removing local admin rights limit what proxied code can do and which installers can run elevated | .007, others (M1050, M1026) |
Rollout
- Measure usage: query 30 days of process telemetry for each proxy binary by host, parent and arguments to see what is genuinely used.
- Audit: deploy the recommended block rules and the ASR rules in audit mode; review blocked-would-be events with application owners.
- Enforce in rings: IT and security staff first, then standard users, with developers and administrators handled through exceptions scoped by device group.
- Add network rules for mshta, regsvr32 and other binaries with no legitimate outbound need.
- Roll back by redeploying the previous App Control policy or switching individual ASR rules to audit, and track every exception with an owner and expiry.
Lessons from incidents
In the SolarWinds supply chain compromise, ATT&CK records that APT29 used Rundll32.exe to execute payloads and that the SUNBURST backdoor itself used rundll32. On a server estate where rundll32 runs constantly for legitimate reasons, only argument, module path and network baselines would distinguish this activity. The broader lesson is that trusted-binary execution on management servers needs the same scrutiny as on workstations, because those servers hold the most powerful credentials.
Common failure patterns
- Allowlisting all of
C:\Windows: every T1218 binary lives there. Without the recommended block rules, application control gives little protection against proxy execution. - Name-only rules: detections on
mshta.exemiss a renamed copy. Use OriginalFileName. - Ignoring module loads: process creation shows rundll32 with a plausible export; only the image load event shows the DLL came from a user's temporary folder.
- Blanket exclusions for installers: excluding msiexec from EDR or proxy inspection because deployments are noisy hides download-and-install abuse.
- Office still allowed to spawn children: most phishing-driven proxy execution begins with an Office or script parent that an ASR rule could have stopped.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1218 and 14 sub-techniques (TA0005); related T1216, T1127, T1220, T1036 | The technique and neighbouring proxy techniques |
| ATT&CK mitigations | M1038, M1042, M1050, M1037, M1021, M1026, M1022 | Official mitigations |
| NIST SP 800-53 Rev. 5 | CM-7 Least Functionality; CM-7(2) Prevent Program Execution; CM-7(5) Authorized Software | Removing and blocking unneeded binaries |
| NIST SP 800-53 Rev. 5 | SI-4 System Monitoring; SC-7 Boundary Protection | Argument, module and network monitoring; outbound restrictions |
| NIST CSF 2.0 | PR.PS-05; DE.CM-09 | Preventing unauthorised software execution; monitoring endpoints |
Practitioner checklist
- Inventory real usage of every T1218 binary by host role, parent and arguments.
- Merge Microsoft's recommended App Control block rules into your policy, audit first, then enforce.
- Enable the Office child process, obfuscated script and script-launching-download ASR rules.
- Collect Sysmon 1, 3, 7, 11 and 22 (or EDR equivalents) and deploy per-binary analytics based on DET0475, DET0282, DET0506 and DET0158.
- Alert on any internet connection from mshta, regsvr32, rundll32 or msiexec with URL arguments on user devices.
- Block HTA, CHM, CPL, MSC and INF files at mail and web gateways.
- Key detections and rules on OriginalFileName to catch renamed copies.
- Review exceptions quarterly and remove any without an owner.
Standards and references
- MITRE ATT&CK: System Binary Proxy Execution (T1218)
- MITRE ATT&CK: Rundll32 (T1218.011)
- MITRE ATT&CK: Mshta (T1218.005)
- Microsoft: Applications that can bypass App Control and how to block them
- Microsoft: Attack surface reduction rules reference
- Microsoft Sysinternals: Sysmon
- LOLBAS Project: Living Off The Land Binaries, Scripts and Libraries
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Living off the Land Guide · Application Allowlisting Guide · T1036 Masquerading Defensive Guide · T1059 Command and Scripting Interpreter Defensive Guide · EDR Guide