T1216

Adversaries may use scripts signed with trusted certificates to proxy execution of malicious files. Several Microsoft signed scripts that are default on Windows installations can be used to proxy execution of other files. This behavior may be abused by adversaries to execute malicious files that could bypass application whitelisting and signature validation on systems.

Adding it as PBA:
- LINUX: not applicable
- WINDOWS: assign an arbitrary script to the comspec environment variable (which points to the CLI), then run some other signed script using cscript which will then attempt to open the CLI but instead execute the arbitrary script assigned to comspec; see this

Mapping the technique to the ATT&CK matrix