T1218: System Binary Proxy Execution
AI Answer
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on (Source: MITRE ATT&CK T1218)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1218 |
| Name | System Binary Proxy Execution |
| Tactic | stealth (stealth) |
| Platforms | Linux, macOS, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, System Binary Proxy Execution (T1218) is one of the highest-connectivity ATT&CK techniques: 2 MITRE STIX relationships reference this technique; 2 threat groups observed using it; 2 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1218).
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Threat Groups
- Volt Typhoon
- Lazarus Group
Group associations are from MITRE ATT&CK STIX relationships.
Related Content
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1218 System Binary Proxy Execution. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1218 System Binary Proxy Execution?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.