系统二进制代理执行是攻击者滥用操作系统信任机制，通过合法签名的系统工具间接执行恶意代码的技术手段。该技术利用微软认证二进制文件（如msbuild.exe、installutil.exe）或Linux系统工具（如split、xxd）的固有功能，将恶意操作嵌入标准工作流程，规避基于进程签名验证和行为规则的检测。防御方通常通过监控异常命令行参数、检测非标准模块加载、分析进程行为偏离基线等手段进行对抗，重点识别合法工具非常规使用模式。
为突破传统检测机制对单一进程异常行为的识别能力，攻击者发展出多层次、多阶段的代理执行匿迹技术。通过内存驻留规避文件扫描、多工具协同分散攻击特征、参数混淆干扰行为分析等手法，将恶意负载深度融入系统管理活动的正常模式中，形成"形合法、质恶意"的新型攻击范式。
当前系统二进制代理执行匿迹技术的核心演进方向集中于信任链滥用与执行环境融合。攻击者通过四维隐匿策略构建深度隐蔽能力：首先，采用内存驻留技术切断攻击链与持久化存储的关联，规避基于文件特征的静态检测；其次，通过多工具链式调用将攻击行为分解为多个低可疑度的微操作，降低单进程行为异常性；最后，运用高级参数混淆技术制造分析噪声，提升行为日志的解读成本。这些技术的共性在于充分利用操作系统信任体系的设计盲区，通过合法组件的非常规组合使用构建攻击路径，使得安全设备难以在缺乏上下文关联的情况下识别恶意意图。
匿迹技术的发展导致传统基于进程黑白名单、命令行规则匹配的防护体系逐步失效。防御方需构建跨进程行为图谱分析能力，结合内存取证和动态污点追踪技术，识别工具链异常协作模式。同时应建立系统工具最小化使用基线，通过机器学习模型检测参数构造的隐蔽语义，提升对高级混淆技术的对抗能力。
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ❌ |
| 行为透明 | ✅ |
| 数据遮蔽 | ✅ |
| 时空释痕 | ✅ |
系统二进制代理执行技术依赖于操作系统中已经签名并被信任的二进制文件，攻击者的行为本身具有一定的透明性，二进制文件的执行不会引起系统或防御工具的警觉。采用内存驻留和反射加载技术，确保恶意代码全程不落盘。攻击载荷通过加密网络传输或注册表存储，执行时在内存中动态解密加载，规避基于文件监控的检测手段。
攻击者通过合法工具参数混淆手段隐藏其恶意操作的技术特征，混淆命令行参数使其与合法任务相似，使得基于命令参数分析的检测机制难以发现恶意行为。此外，利用合法的网络协议和通信方式混淆其攻击通信特征，进一步降低流量监控检测的效果。因此，系统二进制代理执行技术能够利用数据遮蔽匿迹效应躲避检测。
通过多阶段链式代理执行，攻击者不会一次性完成整个攻击流程，而是将恶意操作拆分为多个阶段，分别由不同的合法进程在不同时间点执行。这种策略使攻击活动在时间和空间维度上都具有高度的隐蔽性，防御者需要进行全局的进程行为关联分析，才能察觉完整的攻击链。
| ID | Name | Description |
|---|---|---|
| G0032 | Lazarus Group |
Lazarus Group lnk files used for persistence have abused the Windows Update Client ( |
| G1017 | Volt Typhoon |
Volt Typhoon has used native tools and processes including living off the land binaries or "LOLBins" to maintain and expand access to the victim networks.[3] |
| ID | Mitigation | Description |
|---|---|---|
| M1042 | Disable or Remove Feature or Program |
Many native binaries may not be necessary within a given environment. |
| M1038 | Execution Prevention |
Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network. |
| M1050 | Exploit Protection |
Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using using trusted binaries to bypass application control. |
| M1037 | Filter Network Traffic |
Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic. |
| M1026 | Privileged Account Management |
Restrict execution of particularly vulnerable binaries to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage. |
| M1021 | Restrict Web-Based Content |
Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may forge credential materials that can be used to gain access to web applications or Internet services. |
| DS0022 | File | File Creation |
Monitor for file activity (creations, downloads, modifications, etc.), especially for file types that are not typical within an environment and may be indicative of adversary activity. |
| DS0011 | Module | Module Load |
Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. |
| DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections that are sent or received by untrusted hosts. |
| DS0009 | Process | OS API Execution |
Monitor for API calls that bypass process and/or signature based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. |
| Process Creation |
Monitor processes and command-line parameters for signed binaries that may be used to proxy execution of malicious files. Compare recent invocations of signed binaries that may be used to proxy execution with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Legitimate programs used in suspicious ways, like msiexec.exe downloading an MSI file from the Internet, may be indicative of an intrusion. Correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators. |
||
| DS0024 | Windows Registry | Windows Registry Key Modification |
Monitor for changes made to Windows Registry keys and/or values that may forge credential materials that can be used to gain access to web applications or Internet services. |