Indirect Command Execution T1202
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts. Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file.
Events covered
7 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 7 | Image loaded |
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Authoring guide
Patterns shared across the 62 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (26 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (513 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (79 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 40 rules
- Arbitrary Command Execution Using WSL
- Custom File Open Handler Executes PowerShell
- Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
- Findstr Launching .lnk File
- Indirect Command Execution From Script File Via Bash.EXE
- Indirect Command Execution via SFTP ProxyCommand
- Indirect Inline Command Execution Via Bash.EXE
- Outlook EnableUnsafeClientMailRules Setting Enabled
- Potential Arbitrary Command Execution Using Msdt.EXE
- Potential Arbitrary Command Execution Via FTP.EXE
- Potential Arbitrary DLL Load Using Winword
- Potential Arbitrary File Download Using Office Application
- Potential Arbitrary File Download Via Cmdl32.EXE
- Potential Binary Impersonating Sysinternals Tools
- Potentially Suspicious Child Process Of VsCode
- Potentially Suspicious Child Processes Spawned by ConHost
- Potentially Suspicious Office Document Executed From Trusted Location
- Proxy Execution via Vshadow
- Renamed CURL.EXE Execution
- Renamed FTP.EXE Execution
- Renamed NirCmd.EXE Execution
- Renamed PAExec Execution
- Renamed PingCastle Binary Execution
- Renamed ZOHO Dctask64 Execution
- Rundll32 Execution Without CommandLine Parameters
- Suspicious Cabinet File Execution Via Msdt.EXE
- Suspicious Child Process Of BgInfo.EXE
- Suspicious High IntegrityLevel Conhost Legacy Option
- Suspicious Remote Child Process From Outlook
- Suspicious Runscripthelper.exe
- Suspicious Service Binary Directory
- Suspicious Splwow64 Without Params
- Suspicious ZipExec Execution
- Troubleshooting Pack Cmdlet Execution
- Uncommon Child Process Of BgInfo.EXE
- Uncommon Child Process Of Conhost.EXE
- Uncommon Child Process Of Setres.EXE
- Windows Binary Executed From WSL
- WSL Child Process Anomaly
- WSL Kali-Linux Usage
Elastic 10 rules
- Attempt to Install or Run Kali Linux via WSL
- Command Execution via ForFiles
- Execution via Windows Subsystem for Linux
- Host File System Changes via Windows Subsystem for Linux
- Indirect Command Execution via Forfiles/Pcalua
- Proxy Execution via Console Window Host
- Proxy Execution via Windows OpenSSH
- Suspicious Execution via Windows Subsystem for Linux
- Windows Subsystem for Linux Distribution Installed
- Windows Subsystem for Linux Enabled via Dism Utility
Splunk 12 rules
- Conhost.exe Kernel call (Sysmon)
- Conhost.exe Kernel call (Windows Event Log)
- Indirect Command Execution (Sysmon)
- Indirect Command Execution (Windows Event Log)
- ssh.exe Execution (Sysmon)
- ssh.exe Execution (Windows Event Log)
- Suspicious Conhost.exe Commands (Sysmon)
- Suspicious Conhost.exe Commands (Windows Event Log)
- Windows Indirect Command Execution Via forfiles
- Windows Indirect Command Execution Via pcalua
- Windows Indirect Command Execution Via Series Of Forfiles
- Windows RunMRU Command Execution