Signed diagnostic script sourced to proxy code execution

Siemphony@siemphonymediumT1216unverified

The Windows troubleshooting packs under C:\Windows\diagnostics\ ship a set of signed helper scripts whose exported functions run an arbitrary command, register an arbitrary DLL or load an arbitrary assembly — CL_Invocation.ps1 exposes SyncInvoke, CL_LoadAssembly.ps1 exposes LoadAssemblyFromPath and LoadAssemblyFromNS, CL_Mutexverifiers.ps1 exposes runAfterCancelProcess, and UtilityFunctions.ps1 exposes RegSnapin. Dot-sourcing one of them and calling its function is the class of signed-script proxy execution this parent technique covers, and Script Block Logging is the only source in the brief that shows it, because the dot-source and the call both land in the text of a 4104 event while nothing distinguishable appears in process creation — the payload runs inside the powershell.exe that sourced the file. Two selections are ORed rather than ANDed on purpose: 4104 logs the *content* of a dot-sourced file, so sourcing it matches the filename leg even before the function is called, and a script that pastes the function body inline matches the function leg without naming a file. AN1288 also names pubprn.vbs and, by implication, SyncAppvPublishingServer.vbs; both are deliberately left alone here because they are T1216.001 and T1216.002 and each has its own brief. The installutil.exe the same analytic lists is T1218.004, a different technique, and bare cscript.exe or wscript.exe execution is T1059.005/T1059.007, so neither is treated as a T1216 observable. Prerequisite: PowerShell EventID 4104 requires Script Block Logging, which is off in a default install and in both the Microsoft and CIS baselines — without it this rule returns zero rows, and zero rows reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0466, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where (EventID == 4104 and ((ScriptBlockText contains "CL_Invocation.ps1" or ScriptBlockText contains "CL_LoadAssembly.ps1" or ScriptBlockText contains "CL_Mutexverifiers.ps1" or ScriptBlockText contains "UtilityFunctions.ps1") or (ScriptBlockText contains "SyncInvoke" or ScriptBlockText contains "LoadAssemblyFromPath" or ScriptBlockText contains "LoadAssemblyFromNS" or ScriptBlockText contains "runAfterCancelProcess" or ScriptBlockText contains "RegSnapin")))

Splunk · SPL

Run this as a search.

index=* (EventID="4104" AND ((ScriptBlockText="*CL_Invocation.ps1*" OR ScriptBlockText="*CL_LoadAssembly.ps1*" OR ScriptBlockText="*CL_Mutexverifiers.ps1*" OR ScriptBlockText="*UtilityFunctions.ps1*") OR (ScriptBlockText="*SyncInvoke*" OR ScriptBlockText="*LoadAssemblyFromPath*" OR ScriptBlockText="*LoadAssemblyFromNS*" OR ScriptBlockText="*runAfterCancelProcess*" OR ScriptBlockText="*RegSnapin*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 4104 AND ((TO_LOWER(powershell.file.script_block_text) LIKE "*cl_invocation.ps1*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*cl_loadassembly.ps1*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*cl_mutexverifiers.ps1*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*utilityfunctions.ps1*") OR (TO_LOWER(powershell.file.script_block_text) LIKE "*syncinvoke*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*loadassemblyfrompath*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*loadassemblyfromns*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*runaftercancelprocess*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*regsnapin*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)((CL_Invocation\.ps1|CL_LoadAssembly\.ps1|CL_Mutexverifiers\.ps1|UtilityFunctions\.ps1)|(SyncInvoke|LoadAssemblyFromPath|LoadAssemblyFromNS|runAfterCancelProcess|RegSnapin))</field>    <description>Signed diagnostic script sourced to proxy code execution</description>    <mitre>      <id>T1216</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 0e2e8697-67c7-4402-aa77-f72531eef095

ATT&CKT1216

T1216System Script Proxy Execution

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

The Windows troubleshooting packs under C:\Windows\diagnostics\ ship signed PowerShell helpers whose exported functions run an arbitrary command, register an arbitrary DLL or load an arbitrary assembly. Dot-sourcing one and calling its function is signed-script proxy execution; this rule looks for either half of that in Script Block Logging text. A hit means those script names or function names appeared in a script block. It does not mean an adversary put them there — the packs use themselves.

02 · Telemetry you need

product: windows, service: powershell, copied verbatim from AN1288, matching EventID 4104. Script Block Logging is off in a default install and in both the Microsoft and CIS baselines. Without it the rule returns zero rows, and zero rows reads as quiet when it means blind.
AN1288 also offers process_creation, and the rule's own description overstates the case for discarding it. That claim holds for CL_LoadAssembly.ps1, which loads in-process, but SyncInvoke and runAfterCancelProcess both start an external process — a Sysmon EventID 1 record with powershell.exe as parent and an arbitrary child, which is exactly the lineage MITRE's ParentProcessName and SignedToUnsignedTransition knobs point at. A companion process-creation rule would cover those two legs on estates with no Script Block Logging.

03 · How the logic works

Three selections: selection_event pins EventID: 4104, then selection_script and selection_function are ORed under it. selection_script is ScriptBlockText|contains over four filenames — CL_Invocation.ps1, CL_LoadAssembly.ps1, CL_Mutexverifiers.ps1, UtilityFunctions.ps1. selection_function is ScriptBlockText|contains over the five exported functions they carry: SyncInvoke, LoadAssemblyFromPath, LoadAssemblyFromNS, runAfterCancelProcess, RegSnapin. The OR is deliberate. 4104 logs the content of a dot-sourced file, so sourcing one of these matches the filename leg before any function is called; and a script that pastes a function body inline matches the function leg without ever naming a file. ANDing them would lose both cases. Scope: AN1288's pubprn.vbs and SyncAppvPublishingServer.vbs are left alone as T1216.001 and T1216.002, its installutil.exe is T1218.004, and bare cscript.exe/wscript.exe is T1059.005/.007. Durability note: Microsoft is retiring the inbox troubleshooters. Where the packs are gone, a match implies the signed script was staged by the actor rather than sourced in place — which makes the alert stronger, not weaker.

04 · Common false positives

The troubleshooting packs themselves, overwhelmingly. Running the network, audio, printer, power or Windows Update troubleshooter makes the diagnostic package dot-source these exact files, so their full text lands in 4104 and matches both selections at once. Nothing in the logic separates that from the adversary case: the benign script block and the hostile one are the same event with the same path. It is user-initiated, so it cannot be scheduled around.
That is a rule whose dominant match is ordinary OS behaviour with no discriminator, which does not support level: medium — treat this as low until a discriminator exists.
Then: RMM and self-service tooling calling Invoke-TroubleshootingPack non-interactively under a service account; unrelated third-party scripts carrying their own UtilityFunctions.ps1, a very common name for a shared- function module; and Atomic Red Team T1216 tests, which dot-source CL_Invocation.ps1 and call SyncInvoke precisely because that is the point.

05 · Detection maturity

tier_1: , unavoidably: derived from a MITRE scaffold that contained no query logic and never run against a log line. The function names and paths are correct on paper; that is analysis, not verification.
tier_2: is running it read-only for a fortnight, measuring how often a real estate runs a troubleshooter, and choosing the level from that.
tier_3: ** is correlating a 4104 hit with the unsigned child that follows it, so the alert means proxy execution rather than a user fixing their printer.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Drop the level to low, or add the discriminating leg. MITRE's
Exclude the packs by launch context rather than by filename, so a staged copy
If third-party collisions dominate your baseline, require a function name
Build the companion process-creation rule for the two legs that spawn a child,

Declared by the author

The Windows troubleshooting packs themselves. Running the network, audio, printer, power or Windows Update troubleshooter causes the diagnostic package to dot-source these exact files, so their full script text is written to 4104 verbatim and matches both selections at once. On a user estate this is the highest-volume source by a wide margin, it is user-initiated so it cannot be scheduled around, and it is why the level is medium rather than high.
Help-desk and remediation tooling that invokes a built-in troubleshooter non-interactively, for example an RMM job or a self-service portal action that calls Get-TroubleshootingPack and Invoke-TroubleshootingPack to fix printing or networking, producing the same script blocks under a service account.
Third-party scripts carrying a helper file of their own called UtilityFunctions.ps1, which is a common enough name for a module of shared functions that an unrelated build script, installer or internal module matches selection_script on its dot-source line with no connection to the signed Microsoft copy.
Detection-validation and training material. Atomic Red Team's T1216 tests and LOLBAS demonstration scripts dot-source CL_Invocation.ps1 and call SyncInvoke precisely because that is the behaviour being exercised, so every validation run on every test host matches.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1216, evaluated against their — events.

Share this rule

/u/siemphony/0e2e8697-67c7-4402-aa77-f72531eef095

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Signed diagnostic script sourced to proxy code execution

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it