Trusted tool, untrusted payload Start this lab

Why this matters

When attacker code runs inside a signed, expected Windows utility, the signature checks out and the process tree looks ordinary — the only thing out of place is the file it was pointed at.

Concepts

Objectives graded

• Name the file the signed tool loaded, not the tool itself
• Decide a verdict on the payload before restricting the tool
• Block the same execution path across the estate and confirm it holds

MITRE ATT&CK coverage

A signed system utility loading attacker code, so the signature and the process tree both look right.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The learner named the loaded file, not the signed tool that loaded it.

  investigation · weight 20 · T1218.011 System Binary Proxy Execution: Rundll32 (Defense Evasion)

• The payload was judged rather than the signed tool being condemned.

  investigation · weight 15 · T1036.005 Masquerading: Match Legitimate Name or Location (Defense Evasion)

• The execution path was blocked estate-wide, not just on the one machine.

  behavior · weight 20 · T1218 System Binary Proxy Execution (Defense Evasion)

Common mistakes

• Condemning the signed utility and breaking legitimate software management.
• Cleaning the one machine while the same execution path stays open everywhere else.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.