Signed diagnostic script sourced to proxy code execution

1title: Signed diagnostic script sourced to proxy code execution2id: 0e2e8697-67c7-4402-aa77-f72531eef0953status: experimental4description: |5  The Windows troubleshooting packs under C:\Windows\diagnostics\ ship a set of6  signed helper scripts whose exported functions run an arbitrary command,7  register an arbitrary DLL or load an arbitrary assembly — CL_Invocation.ps18  exposes SyncInvoke, CL_LoadAssembly.ps1 exposes LoadAssemblyFromPath and9  LoadAssemblyFromNS, CL_Mutexverifiers.ps1 exposes runAfterCancelProcess, and10  UtilityFunctions.ps1 exposes RegSnapin. Dot-sourcing one of them and calling11  its function is the class of signed-script proxy execution this parent12  technique covers, and Script Block Logging is the only source in the brief13  that shows it, because the dot-source and the call both land in the text of a14  4104 event while nothing distinguishable appears in process creation — the15  payload runs inside the powershell.exe that sourced the file. Two selections16  are ORed rather than ANDed on purpose: 4104 logs the *content* of a17  dot-sourced file, so sourcing it matches the filename leg even before the18  function is called, and a script that pastes the function body inline matches19  the function leg without naming a file. AN1288 also names pubprn.vbs and, by20  implication, SyncAppvPublishingServer.vbs; both are deliberately left alone21  here because they are T1216.001 and T1216.002 and each has its own brief. The22  installutil.exe the same analytic lists is T1218.004, a different technique,23  and bare cscript.exe or wscript.exe execution is T1059.005/T1059.007, so24  neither is treated as a T1216 observable. Prerequisite: PowerShell EventID25  4104 requires Script Block Logging, which is off in a default install and in26  both the Microsoft and CIS baselines — without it this rule returns zero rows,27  and zero rows reads as quiet when it means blind.28  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0466, not hand-written and not tested by its author. Any lab result is on this rule's own page.29references:30  - https://attack.mitre.org/techniques/T121631  - https://attack.mitre.org/detectionstrategies/DET046632author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)33date: 2026-08-1634tags:35  - attack.defense-evasion36  - attack.t121637logsource:38  product: windows39  service: powershell40detection:41  selection_event:42    EventID: 410443  selection_script:44    ScriptBlockText|contains:45      - 'CL_Invocation.ps1'46      - 'CL_LoadAssembly.ps1'47      - 'CL_Mutexverifiers.ps1'48      - 'UtilityFunctions.ps1'49  selection_function:50    ScriptBlockText|contains:51      - 'SyncInvoke'52      - 'LoadAssemblyFromPath'53      - 'LoadAssemblyFromNS'54      - 'runAfterCancelProcess'55      - 'RegSnapin'56  condition: selection_event and (selection_script or selection_function)57falsepositives:58  - "The Windows troubleshooting packs themselves. Running the network, audio, printer, power or Windows Update troubleshooter causes the diagnostic package to dot-source these exact files, so their full script text is written to 4104 verbatim and matches both selections at once. On a user estate this is the highest-volume source by a wide margin, it is user-initiated so it cannot be scheduled around, and it is why the level is medium rather than high."59  - "Help-desk and remediation tooling that invokes a built-in troubleshooter non-interactively, for example an RMM job or a self-service portal action that calls Get-TroubleshootingPack and Invoke-TroubleshootingPack to fix printing or networking, producing the same script blocks under a service account."60  - "Third-party scripts carrying a helper file of their own called UtilityFunctions.ps1, which is a common enough name for a module of shared functions that an unrelated build script, installer or internal module matches selection_script on its dot-source line with no connection to the signed Microsoft copy."61  - "Detection-validation and training material. Atomic Red Team's T1216 tests and LOLBAS demonstration scripts dot-source CL_Invocation.ps1 and call SyncInvoke precisely because that is the behaviour being exercised, so every validation run on every test host matches."62level: medium