Indirect Command Execution `T1202`

Tactic: Stealth

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts. Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file.

Events covered

8 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4688	A new process has been created.
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

These 71 rules share fields, values, and exclusions.

Fields filtered most (33 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Image`	35	`ends_with` 29, `contains` 7, `eq` 2, `starts_with` 2, `wildcard` 2, `is_null` 1, `regex_match` 1	`\msdt.exe`, `\winword.exe`, `:\temp\`, `:\users\public\`, `:\windows\system32\bash.exe`
`CommandLine`	31	`contains` 21, `ends_with` 4, `regex_match` 4, `wildcard` 2, `eq` 1, `is_not_null` 1, `is_null` 1	`(?i)conhost\.exe.*?\.exe`, `^\S+\s`, `conhost.exe 0xffffffff -ForceV1`, `--exec`, `--install`
`OriginalFileName`	22	`eq` 22	`bash.exe`, `winword.exe`, `excel.exe`, `forfiles.exe`, `ftp.exe`
`ParentImage`	15	`ends_with` 13, `contains` 1, `is_not_null` 1	`\bginfo.exe`, `\bginfo64.exe`, `\conhost.exe`, `\wsl.exe`, `\wslhost.exe`
`event.type`	12	`eq` 12	`start`, `change`
`host.os.type`	12	`eq` 12
`process_name`	12	`eq` 9, `regex_match` 2, `in` 1	`(?i)^ssh\.exe`, `forfiles.exe`, `wsl.exe`, `aa-exec`, `aoss`
`parent_process_name`	7	`eq` 5, `regex_match` 2	`(?i)(forfiles\|fodhelper\|ftp\|pcalua)\.exe`, `forfiles.exe`, `wsl.exe`, `conhost.exe`, `pcalua.exe`
`EventID`	6	`eq` 6	`4688`, `1`
`process.args`	5	`eq` 5, `starts_with` 3, `wildcard` 2, `contains` 1	`&>`, `/etc/passwd`, `/etc/shadow`, `--distribution`, `--headless`
`EventType`	4	`eq` 4	`exec`, `start`, `connection_attempted`
`ParentCommandLine`	4	`eq` 2, `starts_with` 1, `wildcard` 1	`* curl `, `cmd /c `, `conhost* .exe`, `forfiles /c `, `pcalua* -a*`
`operationName`	4	`contains` 3, `in` 1	`DeviceComplianceScript`, `DeviceManagementScript`, `create mobileapp`, `devicehealthscript`, `mobileapp`
`Type`	3	`eq` 3
`CurrentDirectory`	2	`contains` 1, `wildcard` 1	`?:\`, `?:\\AppData\`, `?:\Windows\*`, `\\\\wsl.localhost`

Top indicator values (744 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticAttempt to Install or Run Kali Linux via WSL elasticCommand Execution via ForFiles elasticCurl or Wget Egress Network Connection via LoLBin elasticExecution via Windows Subsystem for Linux elasticHost File System Changes via Windows Subsystem for Linux elasticIndirect Command Execution via Forfiles/Pcalua elasticProxy Execution via Console Window Host elasticProxy Execution via Windows OpenSSH elasticSuspicious Execution via Windows Subsystem for Linux elasticSystem Binary Symlink to Suspicious Location elasticWindows Subsystem for Linux Enabled via Dism Utility	11	1078
`EventID`	`eq`	`4688` splunkConhost.exe Kernel call (Windows Event Log) splunkIndirect Command Execution (Windows Event Log) splunkssh.exe Execution (Windows Event Log) splunkSuspicious Conhost.exe Commands (Windows Event Log)	4	317
`EventID`	`eq`	`1` splunkssh.exe Execution (Sysmon) splunkSuspicious Conhost.exe Commands (Sysmon)	2	241
`Image`	`ends_with`	`\cmd.exe` sigmaPotentially Suspicious Child Process Of VsCode sigmaPotentially Suspicious Child Processes Spawned by ConHost sigmaSuspicious Child Process Of BgInfo.EXE sigmaWSL Child Process Anomaly	4	130
`Image`	`ends_with`	`\cscript.exe` sigmaPotentially Suspicious Child Process Of VsCode sigmaPotentially Suspicious Child Processes Spawned by ConHost sigmaSuspicious Child Process Of BgInfo.EXE sigmaWSL Child Process Anomaly	4	72
`Image`	`ends_with`	`\powershell.exe` sigmaPotentially Suspicious Child Process Of VsCode sigmaPotentially Suspicious Child Processes Spawned by ConHost sigmaSuspicious Child Process Of BgInfo.EXE sigmaWSL Child Process Anomaly	4	179
`Image`	`ends_with`	`\pwsh.exe` sigmaPotentially Suspicious Child Process Of VsCode sigmaPotentially Suspicious Child Processes Spawned by ConHost sigmaSuspicious Child Process Of BgInfo.EXE sigmaWSL Child Process Anomaly	4	165
`Image`	`ends_with`	`\wscript.exe` sigmaPotentially Suspicious Child Process Of VsCode sigmaPotentially Suspicious Child Processes Spawned by ConHost sigmaSuspicious Child Process Of BgInfo.EXE sigmaWSL Child Process Anomaly	4	74
`Image`	`ends_with`	`\calc.exe` sigmaPotentially Suspicious Child Process Of VsCode sigmaSuspicious Child Process Of BgInfo.EXE sigmaWSL Child Process Anomaly	3	14
`Image`	`ends_with`	`\msdt.exe` sigmaDiagnostic Library Sdiageng.DLL Loaded By Msdt.EXE sigmaPotential Arbitrary Command Execution Using Msdt.EXE sigmaSuspicious Cabinet File Execution Via Msdt.EXE	3	9
`Image`	`ends_with`	`\mshta.exe` sigmaPotentially Suspicious Child Processes Spawned by ConHost sigmaSuspicious Child Process Of BgInfo.EXE sigmaWSL Child Process Anomaly	3	66
`Image`	`ends_with`	`\regsvr32.exe` sigmaPotentially Suspicious Child Process Of VsCode sigmaPotentially Suspicious Child Processes Spawned by ConHost sigmaWSL Child Process Anomaly	3	64
`Image`	`ends_with`	`\winword.exe` sigmaPotential Arbitrary DLL Load Using Winword sigmaPotential Arbitrary File Download Using Office Application sigmaPotentially Suspicious Office Document Executed From Trusted Location	3	17
`Image`	`ends_with`	`:\windows\system32\bash.exe` sigmaIndirect Command Execution From Script File Via Bash.EXE sigmaIndirect Inline Command Execution Via Bash.EXE	2	2
`Image`	`ends_with`	`:\windows\syswow64\bash.exe` sigmaIndirect Command Execution From Script File Via Bash.EXE sigmaIndirect Inline Command Execution Via Bash.EXE	2	2
`Image`	`ends_with`	`\excel.exe` sigmaPotential Arbitrary File Download Using Office Application sigmaPotentially Suspicious Office Document Executed From Trusted Location	2	16
`Image`	`ends_with`	`\ftp.exe` sigmaPotential Arbitrary Command Execution Via FTP.EXE sigmaRenamed FTP.EXE Execution	2	2
`Image`	`ends_with`	`\powerpnt.exe` sigmaPotential Arbitrary File Download Using Office Application sigmaPotentially Suspicious Office Document Executed From Trusted Location	2	14
`Image`	`ends_with`	`\rundll32.exe` sigmaPotentially Suspicious Child Process Of VsCode sigmaWSL Child Process Anomaly	2	94
`OriginalFileName`	`eq`	`bash.exe` sigmaIndirect Command Execution From Script File Via Bash.EXE sigmaIndirect Inline Command Execution Via Bash.EXE elasticSuspicious Execution via Windows Subsystem for Linux	3	4
`OriginalFileName`	`eq`	`winword.exe` sigmaPotential Arbitrary DLL Load Using Winword sigmaPotential Arbitrary File Download Using Office Application sigmaPotentially Suspicious Office Document Executed From Trusted Location	3	6
`CommandLine`	`regex_match`	`(?i)conhost\.exe.*?\.exe` splunkSuspicious Conhost.exe Commands (Sysmon) splunkSuspicious Conhost.exe Commands (Windows Event Log)	2	2
`CommandLine`	`regex_match`	`^\S+\s` splunkConhost.exe Kernel call (Sysmon) splunkConhost.exe Kernel call (Windows Event Log)	2	2
`CommandLine`	`regex_match`	`conhost.exe 0xffffffff -ForceV1` splunkConhost.exe Kernel call (Sysmon) splunkConhost.exe Kernel call (Windows Event Log)	2	2
`CommandLine`	`wildcard`	`schtasks` elasticProxy Execution via Console Window Host elasticProxy Execution via Windows OpenSSH	2	2
`EventType`	`eq`	`exec` elasticCurl or Wget Egress Network Connection via LoLBin elasticSystem Binary Symlink to Suspicious Location	2	576
`EventType`	`eq`	`start` elasticIndirect Command Execution via Console Window Host elasticIndirect Command Execution via ForFiles	2	391
`Image`	`contains`	`:\temp\` sigmaPotentially Suspicious Child Process Of VsCode sigmaSuspicious Child Process Of BgInfo.EXE	2	11
`Image`	`contains`	`:\users\public\` sigmaPotentially Suspicious Child Process Of VsCode sigmaSuspicious Child Process Of BgInfo.EXE	2	13
`Image`	`contains`	`:\windows\temp\` sigmaPotentially Suspicious Child Process Of VsCode sigmaSuspicious Child Process Of BgInfo.EXE	2	8

Exclusions (196 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`process_name`	`eq`	`cmd.exe` elasticExecution via Windows Subsystem for Linux elasticIndirect Command Execution via ForFiles	2
`process_name`	`eq`	`powershell.exe` elasticExecution via Windows Subsystem for Linux elasticIndirect Command Execution via Console Window Host	2
`CommandLine`	`contains`	`--install` sigmaWSL Kali-Linux Usage	1
`CommandLine`	`contains`	`--unregister` sigmaWSL Kali-Linux Usage	1
`CommandLine`	`contains`	`-d` sigmaArbitrary Command Execution Using WSL	1
`CommandLine`	`contains`	`-e kill` sigmaArbitrary Command Execution Using WSL	1
`CommandLine`	`contains`	`-i` sigmaWSL Kali-Linux Usage	1
`CommandLine`	`contains`	`/home/linuxbrew/.linuxbrew/` elasticCurl or Wget Egress Network Connection via LoLBin	1
`CommandLine`	`contains`	`bash -` sigmaIndirect Command Execution From Script File Via Bash.EXE	1
`CommandLine`	`contains`	`bash.exe -` sigmaIndirect Command Execution From Script File Via Bash.EXE	1
`CommandLine`	`contains`	`homebrew` elasticCurl or Wget Egress Network Connection via LoLBin	1
`CommandLine`	`contains`	`wau-notify.ps1` elasticProxy Execution via Console Window Host	1
`CommandLine`	`contains`	`webhook` elasticCurl or Wget Egress Network Connection via LoLBin	1
`CommandLine`	`ends_with`	`.dotx` sigmaPotentially Suspicious Office Document Executed From Trusted Location	1
`CommandLine`	`ends_with`	`.potx` sigmaPotentially Suspicious Office Document Executed From Trusted Location	1

Indirect Command Execution `T1202`

Events covered

Authoring guide

Fields filtered most (33 distinct)

Top indicator values (744 distinct)

Exclusions (196 distinct)

Rules under this technique

Sigma 40 rules

Elastic 14 rules

Splunk 15 rules

Panther 2 rules

Indirect Command Execution T1202

Events covered

Authoring guide

Fields filtered most (33 distinct)

Top indicator values (744 distinct)

Exclusions (196 distinct)

Rules under this technique

Sigma 40 rules

Elastic 14 rules

Splunk 15 rules

Panther 2 rules

Indirect Command Execution `T1202`