Wiki › Techniques, Tactics & Procedures (TTPs) › Defense Evasion › Signed Binary Abuse for Evasion

Signed Binary Abuse for Evasion

2 min read

Jump to:

Overview

Signed Binary Abuse for Evasion is a technique where adversaries leverage digitally signed legitimate binaries to execute malicious code while bypassing security controls. This approach is used throughout various stages of the attack lifecycle to evade detection by antivirus, endpoint detection and response (EDR), and other defensive mechanisms that trust signed executables.

Attack Objective

Achieve stealth and evade security detection mechanisms
Supports multiple attack lifecycle stages including Execution, Persistence, Privilege Escalation, and Defense Evasion
Advances attacker position by enabling execution of malicious payloads under the guise of trusted, signed binaries, reducing suspicion and increasing operational security

How the Technique Works

Adversaries exploit the trust placed in signed binaries by using them to run malicious code or scripts. This can involve abusing legitimate signed executables to load malicious libraries, execute embedded scripts, or perform code injection. Because these binaries are signed by trusted vendors, security tools may allow their execution without thorough inspection, facilitating stealthy operations.

Common Methods & Variations

Using signed system utilities or software (e.g., Windows Sysinternals tools) to execute payloads or scripts
Abusing signed installers or update mechanisms to run malicious code
Variants exist across endpoints and cloud environments where signed binaries are present
Living-off-the-land tactics predominate, leveraging existing signed binaries rather than deploying custom malware

Indicators of Compromise (IOCs)

Execution of signed binaries from unusual locations or with uncommon command-line arguments
Unexpected child processes spawned by signed executables
Unusual network connections initiated by signed binaries
Endpoint logs showing signed binary execution outside normal user or system behavior

Detection Strategies

Monitoring process creation events with focus on signed binaries executing uncommon commands or spawning suspicious child processes
Behavioral detection analyzing deviations from typical signed binary usage patterns
Correlation of endpoint telemetry with network and identity logs to identify anomalous activity involving signed executables

Mitigation & Prevention

Application control policies restricting execution of signed binaries to approved contexts and locations
Enforcing least privilege and user access controls to limit binary execution capabilities
Regularly updating allowlists and blocklists to reflect legitimate signed binaries and known abuses

Response Considerations

Immediate containment by terminating suspicious processes and isolating affected systems
Investigate execution context, command-line parameters, and parent-child process relationships to scope impact
Post-incident hardening including tightening application control policies and reviewing signed binary usage

Related Techniques

Living off the Land Binaries and Scripts (LOLBAS)
Code Injection
Process Injection
Signed Script Proxy Execution

Mapping & References

MITRE ATT&CK TTPs: T1218 (Signed Binary Proxy Execution), T1055 (Process Injection), T1106 (Execution through API)
Public research on LOLBAS and signed binary abuse techniques
Security advisories detailing abuse of trusted signed binaries in advanced persistent threat (APT) campaigns

Tags: ATT&CK Cybersecurity Defense Evasion endpoint security Execution Living off the Land persistence privilege escalation Signed Binaries Threat Detection