Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1218

T1218System Binary Proxy Execution

T1218 — System Binary Proxy Execution is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 21 detection use cases covering it and 121 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
21Use cases
121Articles
14Sub-techniques
1Tactic

Sub-techniques (14)

T1218.003 · CMSTPT1218.001 · Compiled HTML FileT1218.002 · Control PanelT1218.015 · Electron ApplicationsT1218.004 · InstallUtilT1218.013 · MavinjectT1218.014 · MMCT1218.005 · MshtaT1218.007 · MsiexecT1218.008 · OdbcconfT1218.009 · Regsvcs/RegasmT1218.010 · Regsvr32T1218.011 · Rundll32T1218.012 · Verclsid

Use cases covering this technique (21)

Office app spawning script/LOLBin child process Internal exploit · alerting DSΣP [WEEKLY] Server / AI-agent process spawns shell or LOLBIN with public egress — post-RCE behavioural chain Internal exploit · alerting DSΣPDD Cisco NVM - Suspicious Network Connection From Process With No Args ESCU actions · hunting P LOLBAS With Network Traffic ESCU actions · alerting P Windows Advanced Installer MSIX with AI_STUBS Execution ESCU actions · alerting P Windows AppLocker Block Events ESCU actions · hunting P Windows AppLocker Execution from Uncommon Locations ESCU actions · hunting P Windows AppLocker Privilege Escalation via Unauthorized Bypass ESCU actions · alerting P Windows AppLocker Rare Application Launch Detection ESCU actions · hunting P Windows BitLockerToGo Process Execution ESCU actions · hunting P Windows BitLockerToGo with Network Activity ESCU actions · hunting P Windows Diskshadow Proxy Execution ESCU actions · alerting P Windows Execute Arbitrary Commands with MSDT ESCU actions · alerting P Windows MSC EvilTwin Directory Path Manipulation ESCU actions · alerting P Windows Proxy Execution of .NET Utilities via Scripts ESCU actions · hunting P Windows Rasautou DLL Execution ESCU actions · alerting P Windows System Script Proxy Execution Syncappvpublishingserver ESCU actions · alerting P [LLM] cscript/wscript executing a script from .laravel_locale temp directory Bespoke install · alerting DSΣPDDCS [LLM] DRILLAPP variant 2: Edge launched with --remote-debugging-port=9222 for CDP-based file download Bespoke c2 · alerting DSΣPDDCS [LLM] Renamed MSBuild.exe executing inline .csproj from user-writable path Bespoke install · alerting DSΣPDDCS [LLM] NosyDoor AppDomainManager hijack: UevAppMonitor.exe executing from non-standard path Bespoke install · alerting DSΣP

Articles citing this technique (121)

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE art-03
high Hacker claims 3.6 million Azure account records stolen from major companies art-06
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
crit How QR-code phishing can slip past corporate security measures art-27
high SafePal data breach impacts 39,798 customers, stolen info for sale art-30
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories art-51
high Curiouser and Curiouser art-52
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS art-55
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud art-58
crit Dissecting the JWR phishing framework art-60
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
crit Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference part art-87
high Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection art-91
high Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise art-97
crit DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure art-98
high Are AI tutors safe for your kids? art-100
crit Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS art-101
crit Inside the Modern SOC: The Identity Front Door art-102
high Why metaphor may dictate your security strategy art-110
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit [GHSA / CRITICAL] CVE-2026-69259: Flowise RCE via SQLite Record Manager Node art-127
high The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software art-131
crit How legitimate cloud platforms enable phishers to bypass MFA art-133
crit An analysis of incidents at Brazilian educational institutions art-146
crit Pass the Passkey: A Novel Attack Surface in Passwordless Authentication art-147
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit You were onto something with “It’s the Climb,” Miley art-165
high ​​​​What’s new in Microsoft Security: July 2026 art-166
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
crit Russian Global Webmail Espionage art-217
high Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters art-237
crit AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report art-250
crit Begun, the Patch Wars have art-253
crit [GHSA / CRITICAL] CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf art-265
crit [GHSA / CRITICAL] GHSA-9hc2-hjx8-q6pv: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Modu art-271
crit ESET Threat Report H1 2026 art-312
high Cyber readiness for SMBs: Getting the basics right art-322
high Inside the inbox: Why cybercriminals want to break into your email account art-337
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
high EvilTokens: A phishing attack that doesn’t steal your password art-377
high npm v12 delivers one of the biggest security improvements in years art-385
med Type Level Security: The future of secure AI code generation? art-409
high What MDM can't protect on developer machines (and what to do about it) art-432
crit ESET APT Activity Report Q4 2025–Q1 2026 art-433
crit BTMOB: A stealthy RAT burrowing deep into Android devices art-443
crit Laravel Lang Supply Chain Advisory art-445
med Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise art-448
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-457
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-481
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-492
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high It's time to treat browser extensions like supply chain attack vectors art-522
crit New NGate variant hides in a trojanized NFC payment app art-536
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-574
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-585
high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-589
crit EDR killers explained: Beyond the drivers art-613
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-623
crit Cyber fallout from the Iran war: What to have on your radar art-626
crit Sednit reloaded: Back in the trenches art-629
crit Protecting education: How MDR can tip the balance in favor of schools art-640
crit PlugX Meeting Invitation via MSBuild and GDATA art-648
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-673
crit Naming and shaming: How ransomware groups tighten the screws on victims art-678
crit Another npm Supply Chain Attack: The 'is' Package Compromise art-687
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758
crit ESET Threat Report H2 2025 art-762
med Why Threat Modeling Is Now Even More Critical for AI-Native Applications art-802
crit Phishing Campaign Leveraging the NPM Ecosystem art-846
crit CISA KEV: CVE-2011-3402 — Microsoft Windows Remote Code Execution Vulnerability art-853
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-875
high npm Supply Chain Attack via Open Source maintainer compromise art-878
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-888
high Snyk Joins CISA's Secure by Design Pledge art-906
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-917
crit CISA KEV: CVE-2024-38226 — Microsoft Publisher Protection Mechanism Failure Vulnerability art-1253
crit CISA KEV: CVE-2024-4879 — ServiceNow Improper Input Validation Vulnerability art-1301
high A stepping stone towards holistic application risk and compliance management of the Digital Operational Resiliency Act (DORA) art-1312
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1319
high Snyk AppRisk Pro: A holistic approach to application risk management art-1368
crit Snyk Learn and the NIST Cybersecurity Framework (CSF) art-1405
high Defense in Depth art-1415
crit New Year's security resolutions for 2024 from Snyk DevRel, SecRel, and friends art-1444
high Cybersecurity Venture’s 2023 Software Supply Chain Attack Report art-1561
high XS leaks: What they are and how to avoid them art-1663
high Ethical hacking techniques art-1721
high Ethical Hacking: Top Tools art-1725
high Three considerations for building an effective security program art-1764
crit API Security Guide art-1774
high Securing the web (forward) art-1826
crit The rising trend of malicious packages in open source ecosystems art-1827
high Cybersecurity Hygiene 101 art-1847
crit Key points from Google and Accenture's ransomware white paper art-1958
crit Secure Python URL validation art-1960
crit Understanding DNS attacks: Identifying and patching vulnerabilities art-1972
high Avoiding SMTP Injection: A Whitebox primer art-2029
high Securing PHP containers art-2105
crit CISA KEV: CVE-2013-1331 — Microsoft Office Buffer Overflow Vulnerability art-2166
crit CISA KEV: CVE-2009-0563 — Microsoft Office Buffer Overflow Vulnerability art-2181
crit Alert: LaughTilYouCry ransomware sabotages npm package (with puns) art-2365
crit CISA KEV: CVE-2015-1770 — Microsoft Office Uninitialized Memory Use Vulnerability art-2398
crit CISA KEV: CVE-2014-6287 — Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability art-2461
high How Snyk helps satisfy White House cybersecurity recommendations art-2477
crit CISA KEV: CVE-2015-2424 — Microsoft PowerPoint Memory Corruption Vulnerability art-2586
med Getting started at a new organization art-2686
crit The Secure Developer: 2021 in review art-2714
high How Dun & Bradstreet and Shutterstock built successful security champions programs art-3091
high Docker Hub authentication: Is 2021 the year you enable 2FA on Docker Hub? art-3219
crit What is typosquatting and how typosquatting attacks are responsible for malicious modules in npm art-3249
high Cheatsheet: top 10 application security acronyms art-3270
med Python Poetry package manager and security integration with software composition analysis tool art-3283
crit Demystifying HTTP request smuggling art-3358
med Security digital transformation with James Kaplan art-3477
high ReDoS vulnerabilities in npm spikes by 143% and XSS continues to grow art-3577
high How even quick Node.js async functions can block the Event-Loop art-3593
med Python 2 vs 3: Security Differences art-3655
crit XSS Attacks: The Next Wave art-3664
high Which of the OWASP Top 10 Caused the World’s Biggest Data Breaches? art-3667
high A CEO's guide to Emacs art-3716