EXPLORE
← Back to Explore
T1202

Indirect Command Execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may...

Windows
56
Detections
3
Sources
2
Threat Actors

BY SOURCE

38sigma12elastic6splunk_escu

PROCEDURES (26)

Process Creation Monitoring13 detections

Auto-extracted: 13 detections for process creation monitoring

General Monitoring5 detections

Auto-extracted: 5 detections for general monitoring

Child Process5 detections

Auto-extracted: 5 detections for child process

Suspicious4 detections

Auto-extracted: 4 detections for suspicious

Parent Process2 detections

Auto-extracted: 2 detections for parent process

Macro2 detections

Auto-extracted: 2 detections for macro

Persist2 detections

Auto-extracted: 2 detections for persist

Download2 detections

Auto-extracted: 2 detections for download

Bypass2 detections

Auto-extracted: 2 detections for bypass

Parent Process2 detections

Auto-extracted: 2 detections for parent process

Inject2 detections

Auto-extracted: 2 detections for inject

Script Execution Monitoring1 detections

Auto-extracted: 1 detections for script execution monitoring

Privilege1 detections

Auto-extracted: 1 detections for privilege

Evasion1 detections

Auto-extracted: 1 detections for evasion

Remote1 detections

Auto-extracted: 1 detections for remote

Registry1 detections

Auto-extracted: 1 detections for registry

Privilege1 detections

Auto-extracted: 1 detections for privilege

Download1 detections

Auto-extracted: 1 detections for download

Powershell1 detections

Auto-extracted: 1 detections for powershell

Module Load Monitoring1 detections

Auto-extracted: 1 detections for module load monitoring

Remote1 detections

Auto-extracted: 1 detections for remote

Cloud Monitoring1 detections

Auto-extracted: 1 detections for cloud monitoring

Office1 detections

Auto-extracted: 1 detections for office

Evasion1 detections

Auto-extracted: 1 detections for evasion

Bypass1 detections

Auto-extracted: 1 detections for bypass

Powershell1 detections

Auto-extracted: 1 detections for powershell

THREAT ACTORS (2)

DETECTIONS (56)

Attempt to Install Kali Linux via WSL
elastichigh
Command Execution via ForFiles
elasticmedium
Curl or Wget Egress Network Connection via LoLBin
elasticmedium
Custom File Open Handler Executes PowerShell
sigmahigh
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
sigmahigh
Execution via Windows Subsystem for Linux
elasticmedium
Findstr Launching .lnk File
sigmamedium
Host File System Changes via Windows Subsystem for Linux
elasticmedium
Indirect Command Execution From Script File Via Bash.EXE
sigmamedium
Indirect Inline Command Execution Via Bash.EXE
sigmamedium
Linux Restricted Shell Breakout via Linux Binary(s)
elasticmedium
Microsoft Intune Device Health Scripts
splunk_escu
Microsoft Intune Mobile Apps
splunk_escu
Outlook EnableUnsafeClientMailRules Setting Enabled
sigmahigh
Potential Arbitrary Command Execution Using Msdt.EXE
sigmahigh
Potential Arbitrary Command Execution Via FTP.EXE
sigmamedium
Potential Arbitrary DLL Load Using Winword
sigmamedium
Potential Arbitrary File Download Using Office Application
sigmahigh
Potential Arbitrary File Download Via Cmdl32.EXE
sigmamedium
Potential Binary Impersonating Sysinternals Tools
sigmamedium
Potentially Suspicious Child Process Of VsCode
sigmamedium
Potentially Suspicious Child Processes Spawned by ConHost
sigmahigh
Potentially Suspicious Office Document Executed From Trusted Location
sigmahigh
Proxy Execution via Console Window Host
elastichigh
Proxy Execution via Vshadow
sigmamedium
Proxy Execution via Windows OpenSSH
elastichigh
Renamed CURL.EXE Execution
sigmamedium
Renamed FTP.EXE Execution
sigmamedium
Renamed NirCmd.EXE Execution
sigmahigh
Renamed PAExec Execution
sigmahigh
Renamed PingCastle Binary Execution
sigmahigh
Renamed ZOHO Dctask64 Execution
sigmahigh
Rundll32 Execution Without CommandLine Parameters
sigmahigh
Suspicious Cabinet File Execution Via Msdt.EXE
sigmamedium
Suspicious Child Process Of BgInfo.EXE
sigmahigh
Suspicious Execution via Windows Subsystem for Linux
elasticlow
Suspicious High IntegrityLevel Conhost Legacy Option
sigmainformational
Suspicious Remote Child Process From Outlook
sigmahigh
Suspicious Runscripthelper.exe
sigmamedium
Suspicious Service Binary Directory
sigmahigh
Suspicious Splwow64 Without Params
sigmahigh
Suspicious ZipExec Execution
sigmamedium
System Binary Symlink to Suspicious Location
elasticlow
Troubleshooting Pack Cmdlet Execution
sigmamedium
Uncommon Child Process Of BgInfo.EXE
sigmamedium
Uncommon Child Process Of Conhost.EXE
sigmamedium
Uncommon Child Process Of Setres.EXE
sigmahigh
Windows Binary Executed From WSL
sigmamedium
Windows Indirect Command Execution Via forfiles
splunk_escu
Windows Indirect Command Execution Via pcalua
splunk_escu
Windows Indirect Command Execution Via Series Of Forfiles
splunk_escu
Windows RunMRU Command Execution
splunk_escu
Windows Subsystem for Linux Distribution Installed
elasticmedium
Windows Subsystem for Linux Enabled via Dism Utility
elasticmedium
WSL Child Process Anomaly
sigmamedium
WSL Kali-Linux Usage
sigmahigh