Signed script-host execution

lolbin_script_host_exec

Uses the signed script hosts — mshta, regsvr32 with scrobj, rundll32, wmic, cscript, osascript, perl, python — to execute an inert instruction that writes a marker file in the sandbox, and records which of those execution routes are permitted.

Severity high how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1059.005	Visual Basic	Execution	coverage statistics
T1218.005	Mshta	Defense Evasion	coverage statistics
T1218.010	Regsvr32	Defense Evasion	coverage statistics
T1218.011	Rundll32	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other living off the land tests

Other tests in the Living off the land category.
Test	What it does	Severity
Living-off-the-land download cradles lolbin_download_cradles	Fetches a two-byte file from the benchmark's own endpoint using each signed OS tool an attacker would use for it — certutil, bitsadmin, curl, wget, py…	high
Decoding an encoded payload with a signed tool lolbin_certutil_decode_payload	Writes a base64-encoded EICAR test file and decodes it in place with the platform's own signed decoder (certutil on Windows, base64 elsewhere), which …	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.