Indirect Command Execution T1202

Events covered

7 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 69 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (33 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (735 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (161 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 40 rules

• Arbitrary Command Execution Using WSL
• Custom File Open Handler Executes PowerShell
• Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
• Findstr Launching .lnk File
• Indirect Command Execution From Script File Via Bash.EXE
• Indirect Command Execution via SFTP ProxyCommand
• Indirect Inline Command Execution Via Bash.EXE
• Outlook EnableUnsafeClientMailRules Setting Enabled
• Potential Arbitrary Command Execution Using Msdt.EXE
• Potential Arbitrary Command Execution Via FTP.EXE
• Potential Arbitrary DLL Load Using Winword
• Potential Arbitrary File Download Using Office Application
• Potential Arbitrary File Download Via Cmdl32.EXE
• Potential Binary Impersonating Sysinternals Tools
• Potentially Suspicious Child Process Of VsCode
• Potentially Suspicious Child Processes Spawned by ConHost
• Potentially Suspicious Office Document Executed From Trusted Location
• Proxy Execution via Vshadow
• Renamed CURL.EXE Execution
• Renamed FTP.EXE Execution
• Renamed NirCmd.EXE Execution
• Renamed PAExec Execution
• Renamed PingCastle Binary Execution
• Renamed ZOHO Dctask64 Execution
• Rundll32 Execution Without CommandLine Parameters
• Suspicious Cabinet File Execution Via Msdt.EXE
• Suspicious Child Process Of BgInfo.EXE
• Suspicious High IntegrityLevel Conhost Legacy Option
• Suspicious Remote Child Process From Outlook
• Suspicious Runscripthelper.exe
• Suspicious Service Binary Directory
• Suspicious Splwow64 Without Params
• Suspicious ZipExec Execution
• Troubleshooting Pack Cmdlet Execution
• Uncommon Child Process Of BgInfo.EXE
• Uncommon Child Process Of Conhost.EXE
• Uncommon Child Process Of Setres.EXE
• Windows Binary Executed From WSL
• WSL Child Process Anomaly
• WSL Kali-Linux Usage

Elastic 13 rules

• Attempt to Install or Run Kali Linux via WSL
• Command Execution via ForFiles
• Curl or Wget Egress Network Connection via LoLBin
• Execution via Windows Subsystem for Linux
• Host File System Changes via Windows Subsystem for Linux
• Indirect Command Execution via Forfiles/Pcalua
• Linux Restricted Shell Breakout via Linux Binary(s)
• Proxy Execution via Console Window Host
• Proxy Execution via Windows OpenSSH
• Suspicious Execution via Windows Subsystem for Linux
• System Binary Symlink to Suspicious Location
• Windows Subsystem for Linux Distribution Installed
• Windows Subsystem for Linux Enabled via Dism Utility

Splunk 14 rules

• Conhost.exe Kernel call (Sysmon)
• Conhost.exe Kernel call (Windows Event Log)
• Indirect Command Execution (Sysmon)
• Indirect Command Execution (Windows Event Log)
• Microsoft Intune Device Health Scripts
• Microsoft Intune Mobile Apps
• ssh.exe Execution (Sysmon)
• ssh.exe Execution (Windows Event Log)
• Suspicious Conhost.exe Commands (Sysmon)
• Suspicious Conhost.exe Commands (Windows Event Log)
• Windows Indirect Command Execution Via forfiles
• Windows Indirect Command Execution Via pcalua
• Windows Indirect Command Execution Via Series Of Forfiles
• Windows RunMRU Command Execution

Panther 2 rules

• Intune Create or Modify Client App
• Intune New Device Management Script