Meta tags:

Headings (most frequently used words):

trusted, developer, utilities, proxy, execution, mitigations, detection, strategy, references, sub, techniques,

Text of the page (most frequently used words):
#developer (11), utilities (11), execution (11), att (10), all (10), may (9), t1127 (9), and (8), exe (8), #trusted (8), enterprise (7), proxy (7), techniques (6), retrieved (6), the (5), ics (5), mobile (5), none (5), control (5), that (5), mitre (4), software (4), detection (4), smart (4), app (4), application (4), 2017 (4), from (4), version (4), malicious (4), code (4), 2026 (3), are (3), cti (3), data (3), mitigations (3), defenses (3), sub (3), tactics (3), bypassing (3), whitelisting (3), using (3), november (3), signed (3), for (3), windows (3), not (3), used (3), applications (3), adversaries (3), corporation (2), domains (2), resources (2), reference (2), campaigns (2), groups (2), components (2), analytics (2), strategies (2), assets (2), matrices (2), core (2), objects (2), 2024 (2), august (2), 2025 (2), microsoft (2), 2016 (2), nelson (2), unsigned (2), user (2), writable (2), strategy (2), analytic (2), description (2), name (2), should (2), feature (2), 003 (2), 002 (2), 001 (2), safe (2), them (2), system (2), development (2), can (2), execute (2), with (2), ckcon (2), person (2), tickets (2), faq (2), 2015, registered, trademarks, cookie, preferences, website, changelog, privacy, policy, terms, use, contact, reset, filters, joe, desimone, dismantling, march, frequently, asked, questions, april, lolbas, tracker, july, 2019, graeber, windbg, cdb, shellcode, runner, rcsi, dnx, references, utility, parent, executed, non, context, spawns, suspicious, children, powershell, cmd, rundll32, regsvr32, wscript, loads, dlls, writes, then, runs, new, paths, immediately, makes, outbound, network, connections, an0488, behavior, chain, platform, aware, det0172, consider, disabling, installation, internet, via, restrict, web, based, content, m1021, certain, blocked, restricted, required, prevention, m1038, specific, necessary, within, given, environment, removed, disable, remove, program, m1042, mitigation, live, permalink, last, modified, created, casey, smith, matthew, demaske, adaptforward, contributors, platforms, stealth, blocks, considers, potentially, running, verifying, against, known, list, cloud, service, before, executing, however, leverage, reputation, hijacking, abuse, operating, trust, support, arbitrary, leveraging, run, their, bypass, protections, take, advantage, payloads, there, many, related, tasks, various, forms, assist, debugging, reverse, engineering, these, often, legitimate, certificates, allow, through, process, effectively, bypasses, solutions, jamplus, clickonce, msbuild, home, open, join, october, mclean, hotel, location, details, found, register, here, search, blog, contribute, benefactors, legal, branding, updates, history, engage, tools, advisory, council, learn, more, about, get, started, detections, technique,

Text of the page (random words):
trusted developer utilities proxy execution technique t1127 enterprise mitre att ck matrices enterprise mobile ics tactics enterprise mobile ics techniques enterprise mobile ics defenses mitigations enterprise mobile ics assets detections detection strategies analytics data components cti groups software campaigns resources get started learn more about att ck att ck advisory council att ckcon att ck data tools faq engage with att ck version history updates legal branding benefactors contribute blog search att ckcon 7 0 in person tickets are open join us october 27 28 2026 in mclean va register here for in person tickets hotel and location details can be found in the faq home techniques enterprise trusted developer utilities proxy execution trusted developer utilities proxy execution sub techniques 3 id name t1127 001 msbuild t1127 002 clickonce t1127 003 jamplus adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads there are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development debugging and reverse engineering 1 2 3 4 these utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions smart app control is a feature of windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a microsoft cloud service before executing them 5 however adversaries may leverage reputation hijacking to abuse an operating system s trust of safe signed applications that support the execution of arbitrary code by leveraging trusted developer utilities proxy execution to run their malicious code adversaries may bypass smart app control protections 6 id t1127 sub techniques t1127 001 t1127 002 t1127 003 ⓘ tactics stealth execution ⓘ platforms windows contributors casey smith matthew demaske adaptforward version 2 0 created 31 may 2017 last modified 12 may 2026 version permalink live version mitigations id mitigation description m1042 disable or remove feature or program specific developer utilities may not be necessary within a given environment and should be removed if not used m1038 execution prevention certain developer utilities should be blocked or restricted if not required m1021 restrict web based content consider disabling software installation or execution from the internet via developer utilities detection strategy id name analytic id analytic description det0172 behavior chain platform aware detection strategy for t1127 trusted developer utilities proxy execution windows an0488 a trusted signed developer utility parent is executed in a non developer context and a spawns suspicious children e g powershell exe cmd exe rundll32 exe regsvr32 exe wscript exe b loads unsigned user writable dlls c writes and then runs a new pe from user writable paths and or d immediately makes outbound network connections references nelson m 2017 november 17 bypassing application whitelisting by using dnx exe retrieved may 25 2017 nelson m 2016 november 21 bypassing application whitelisting by using rcsi exe retrieved may 26 2017 graeber m 2016 august 15 bypassing application whitelisting by using windbg cdb as a shellcode runner retrieved november 17 2024 lolbas n d tracker exe retrieved july 31 2019 microsoft n d smart app control frequently asked questions retrieved april 4 2025 joe desimone 2024 august 5 dismantling smart app control retrieved march 21 2025 core objects all core att ck objects all none matrices tactics techniques sub techniques defenses all defenses all none mitigations assets detection strategies analytics data components cti all cti all none groups software campaigns reference all reference all none resources domains all domains all none enterprise mobile ics reset filters contact us terms of use privacy policy website changelog cookie preferences 2015 2026 the mitre corporation mitre att ck and att ck are registered trademarks of the mitre corporation