System Binary Proxy Execution T1218
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already…
- Tactics
- Stealth
- Actors using it
- 48
- Sub-techniques
- 10
Ransomware groups reported using it
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT28Russia · IRON TWILIGHT, SNAKEMACKEREL, Swallowtail · 73 techniques
- APT38North Korea · NICKEL GLADSTONE, BeagleBoyz, Bluenoroff · 70 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- APT41China · Wicked Panda, Brass Typhoon, BARIUM · 66 techniques
- Sandworm TeamRussia · ELECTRUM, Telebots, IRON VIKING · 64 techniques
- Mustang PandaChina · TA416, RedDelta, BRONZE PRESIDENT · 61 techniques
- Volt TyphoonChina · BRONZE SILHOUETTE, Vanguard Panda, DEV-0391 · 58 techniques
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- Magic HoundIran · TA453, COBALT ILLUSION, Charming Kitten · 58 techniques
- APT32Vietnam · SeaLotus, OceanLotus, APT-C-00 · 55 techniques
- Gamaredon GroupRussia · IRON TILDEN, Primitive Bear, ACTINIUM · 55 techniques
- Medusa Group52 techniques
- FIN7GOLD NIAGARA, ITG14, Carbon Spider · 50 techniques
- Wizard SpiderRussia · UNC1878, TEMP.MixMaster, Grim Spider · 49 techniques
- MuddyWaterIran · Earth Vetala, MERCURY, Static Kitten · 48 techniques
- APT29Russia · IRON RITUAL, IRON HEMLOCK, NobleBaron · 47 techniques
- APT3China · Gothic Panda, Pirpi, UPS Team · 40 techniques
- menuPassChina · Cicada, POTASSIUM, Stone Panda · 37 techniques
- HAFNIUMChina · Operation Exchange Marauder, Silk Typhoon · 37 techniques
- UNC3886China · 37 techniques
- LeviathanChina · MUDCARP, Kryptonite Panda, Gadolinium · 37 techniques
- Storm-050134 techniques
- Earth LuscaChina · TAG-22, Charcoal Typhoon, CHROMIUM · 34 techniques
- RedCurlRussia · 32 techniques
- Cobalt GroupGOLD KINGSWOOD, Cobalt Gang, Cobalt Spider · 26 techniques
- ZIRCONIUMChina · APT31, Violet Typhoon · 25 techniques
- Aquatic PandaChina · 25 techniques
- SilenceWhisper Spider · 25 techniques
- TA505Hive0065, Spandex Tempest, CHIMBORAZO · 24 techniques
- SidewinderIndia · T-APT-04, Rattlesnake · 23 techniques
- WIRTEAshen Lepus · 21 techniques
- TA254120 techniques
- InceptionInception Framework, Cloud Atlas · 20 techniques
- Blue Mockingbird19 techniques
- APT19China · Codoso, C0d0so0, Codoso Team · 18 techniques
- DaggerflyChina · Evasive Panda, BRONZE HIGHLAND · 17 techniques
- ConfuciusConfucius APT · 16 techniques
- SideCopyPakistan · 15 techniques
- LazyScripter13 techniques
- MoleratsOperation Molerats, Gaza Cybergang · 12 techniques
- Dark CaracalLebanon · 11 techniques
- TA551GOLD CABIN, Shathak · 11 techniques
- Deep PandaChina · Shell Crew, WebMasters, KungFu Kittens · 10 techniques
- CarbanakAnunak · 8 techniques
- Rancor8 techniques
- MacheteSpain · APT-C-43, El Machete · 7 techniques
- CopyKittensIran · 7 techniques