Trusted-binary proxy execution is a technique where an attacker uses a legitimate, signed, or built-in operating system tool to launch malicious code. Instead of dropping a clearly suspicious loader, the attacker “proxies” execution through a trusted process such as a script host, installer, or document handler. Because the parent binary is normal software, the activity may blend into routine administration or user-driven workflows.
This matters because many defenses initially focus on file reputation and unknown executables. If malicious content is started by a trusted binary, those checks can miss the real risk. In attacks, this often appears as unusual command lines, strange parent-child process chains, or a system tool opening script, HTML Application, or remote content. Defenders look for those anomalies, restrict unnecessary tools with application control, and use behavioral detections to flag trusted binaries that act like launchers for malware.