MITRE ATT&CK - Técnica

T1127: Trusted Developer Utilities Proxy Execution

Trusted Developer Utilities Proxy Execution (T1127) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1127 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, Trusted Developer Utilities Proxy Execution deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Stealth e Execution. As plataformas mapeadas pela MITRE incluem Windows. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Stealth, Execution
Plataformas MITRE Windows

Descrição oficial original do MITRE ATT&CK

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering. These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them. However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging Trusted Developer Utilities Proxy Execution to run their malicious code, adversaries may bypass Smart App Control protections.

Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica Trusted Developer Utilities Proxy Execution automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma