{"id":"T1202","name":"Indirect Command Execution","url":"https://attack.mitre.org/techniques/T1202","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0200","stix_id":"x-mitre-detection-strategy--f3cc2f0f-c657-4453-90a8-d7c9a59d6e37","name":"Indirect Command Execution – Windows utility abuse behavior chain","url":"https://attack.mitre.org/detectionstrategies/DET0200","analytics":[{"id":"AN0576","stix_id":"x-mitre-analytic--9f3aea30-e100-432a-8aa0-959bd7f4e069","name":"Analytic 0576","description":"Cause→effect chain: (1) A user or service launches an indirection utility (e.g., forfiles.exe, pcalua.exe, wsl.exe, scriptrunner.exe, ssh.exe with -o ProxyCommand/LocalCommand). (2) That utility spawns a secondary program/command (PowerShell, cmd, msiexec, regsvr32, curl, arbitrary EXE) and/or opens outbound network connections. (3) Optional precursor modification of SSH config to persist LocalCommand/ProxyCommand. Correlate process creation, command/script content, file access to %USERPROFILE%\\.ssh\\config, and network connections from the utility or its child.","url":"https://attack.mitre.org/detectionstrategies/DET0200#AN0576","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation window between indirect launcher and spawned child/network activity (e.g., 10–30 minutes)."},{"field":"AllowedUtilities","description":"Utilities permitted on admin/Jumphosts (forfiles, wsl, ssh) to reduce noise."},{"field":"HighRiskChildren","description":"Child images that indicate abuse (powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, mshta.exe, msiexec.exe, curl.exe, bitsadmin.exe)."},{"field":"UserContext","description":"Raise severity when the actor is a standard/interactive user on a workstation rather than a server or CI agent."},{"field":"DestCIDRs","description":"Known-good egress networks for SSH/WSL activity to suppress expected admin automations."}],"live":true,"detection_strategies":["DET0200"],"techniques":["T1202"]}],"live":true,"version":"1.0","techniques":["T1202"]}],"sigma_rules":[{"id":"03409c93-a7c7-49ba-9a4c-a00badf2a153","title":"Troubleshooting Pack Cmdlet Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-21","modified":null,"description":"Detects execution of \"TroubleshootingPack\" cmdlets to leverage CVE-2022-30190 or action similar to \"msdt\" lolbin (as described in LOLBAS)","references":["https://twitter.com/nas_bench/status/1537919885031772161","https://lolbas-project.github.io/lolbas/Binaries/Msdt/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml","techniques":["T1202"],"cves":[]},{"id":"06b401f4-107c-4ff9-947f-9ec1e7649f1e","title":"Potential Arbitrary Command Execution Via FTP.EXE","author":"Victor Sergeev, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2024-04-23","description":"Detects execution of \"ftp.exe\" script with the \"-s\" or \"/s\" flag and any child processes ran by \"ftp.exe\".","references":["https://lolbas-project.github.io/lolbas/Binaries/Ftp/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"1775e15e-b61b-4d14-a1a3-80981298085a","title":"Rundll32 Execution Without CommandLine Parameters","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-05-27","modified":"2023-08-31","description":"Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity","references":["https://www.cobaltstrike.com/help-opsec","https://twitter.com/ber_m1ng/status/1397948048135778309"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_no_params.yml","techniques":["T1202"],"cves":[]},{"id":"1f1a8509-2cbb-44f5-8751-8e1571518ce2","title":"Suspicious Splwow64 Without Params","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2022-12-25","description":"Detects suspicious Splwow64.exe process without any command line parameters","references":["https://twitter.com/sbousseaden/status/1429401053229891590?s=12"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_splwow64_cli_anomaly.yml","techniques":["T1202"],"cves":[]},{"id":"2267fe65-0681-42ad-9a6d-46553d3f3480","title":"WSL Child Process Anomaly","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-23","modified":"2023-08-15","description":"Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/","https://twitter.com/nas_bench/status/1535431474429808642"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"2433a154-bb3d-42e4-86c3-a26bdac91c45","title":"Renamed PingCastle Binary Execution","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"high","date":"2024-01-11","modified":null,"description":"Detects the execution of a renamed \"PingCastle\" binary based on the PE metadata fields.","references":["https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://www.pingcastle.com/documentation/scanner/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"258fc8ce-8352-443a-9120-8a11e4857fa5","title":"Potential Arbitrary Command Execution Using Msdt.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-05-29","modified":"2024-03-13","description":"Detects processes leveraging the \"ms-msdt\" handler or the \"msdt.exe\" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability","references":["https://twitter.com/nao_sec/status/1530196847679401984","https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/","https://twitter.com/_JohnHammond/status/1531672601067675648"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml","techniques":["T1202"],"cves":[]},{"id":"264982dc-dbad-4dce-b707-1e0d3e0f73d9","title":"Renamed NirCmd.EXE Execution","author":"X__Junior (Nextron Systems)","status":"test","level":"high","date":"2024-03-11","modified":null,"description":"Detects the execution of a renamed \"NirCmd.exe\" binary based on the PE metadata fields.","references":["https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/","https://www.nirsoft.net/utils/nircmd.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_renamed_nircmd.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"277a4393-446c-449a-b0ed-7fdc7795244c","title":"Renamed FTP.EXE Execution","author":"Victor Sergeev, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2023-02-03","description":"Detects the execution of a renamed \"ftp.exe\" binary based on the PE metadata fields","references":["https://lolbas-project.github.io/lolbas/Binaries/Ftp/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_renamed_ftp.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"2d22a514-e024-4428-9dba-41505bd63a5b","title":"Indirect Command Execution From Script File Via Bash.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-15","modified":null,"description":"Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly.\nThis can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Bash/","https://linux.die.net/man/1/bash","Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_bash_file_execution.yml","techniques":["T1202"],"cves":[]},{"id":"3037d961-21e9-4732-b27a-637bcc7bf539","title":"Suspicious High IntegrityLevel Conhost Legacy Option","author":"frack113","status":"test","level":"informational","date":"2022-12-09","modified":"2024-12-01","description":"ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.","references":["https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29","https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/","https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_conhost_legacy_option.yml","techniques":["T1202"],"cves":[]},{"id":"33339be3-148b-4e16-af56-ad16ec6c7e7b","title":"Findstr Launching .lnk File","author":"Trent Liffick","status":"test","level":"medium","date":"2020-05-01","modified":"2024-01-15","description":"Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack","references":["https://www.bleepingcomputer.com/news/security/hhsgov-open-redirect-used-by-coronavirus-phishing-to-spread-malware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1202","attack.t1027.003"],"path":"rules/windows/process_creation/proc_creation_win_findstr_lnk.yml","techniques":["T1036","T1202","T1027.003"],"cves":[]},{"id":"340a090b-c4e9-412e-bb36-b4b16fe96f9b","title":"Renamed ZOHO Dctask64 Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-01-28","modified":"2025-01-22","description":"Detects a renamed \"dctask64.exe\" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.\nThis binary can be abused for DLL injection, arbitrary command and process execution.\n","references":["https://twitter.com/gN3mes1s/status/1222088214581825540","https://twitter.com/gN3mes1s/status/1222095963789111296","https://twitter.com/gN3mes1s/status/1222095371175911424"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1036","attack.t1055.001","attack.t1202","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_renamed_dctask64.yml","techniques":["T1036","T1055.001","T1202","T1218"],"cves":[]},{"id":"4ae3e30b-b03f-43aa-87e3-b622f4048eed","title":"Potential Arbitrary File Download Using Office Application","author":"Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community","status":"test","level":"high","date":"2022-05-17","modified":"2023-06-22","description":"Detects potential arbitrary file download using a Microsoft Office application","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/","https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml","techniques":["T1202"],"cves":[]},{"id":"55f0a3a1-846e-40eb-8273-677371b8d912","title":"Outlook EnableUnsafeClientMailRules Setting Enabled","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2018-12-27","modified":"2023-02-09","description":"Detects an attacker trying to enable the outlook security setting \"EnableUnsafeClientMailRules\" which allows outlook to run applications or execute macros","references":["https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44","https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"5a3164f2-b373-4152-93cf-090b13c12d27","title":"Potentially Suspicious Child Process Of VsCode","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-26","modified":"2023-10-25","description":"Detects uncommon or suspicious child processes spawning from a VsCode \"code.exe\" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.","references":["https://twitter.com/nas_bench/status/1618021838407495681","https://twitter.com/nas_bench/status/1618021415852335105"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"5edc2273-c26f-406c-83f3-f4d948e740dd","title":"Indirect Inline Command Execution Via Bash.EXE","author":"frack113","status":"test","level":"medium","date":"2021-11-24","modified":"2023-08-15","description":"Detects execution of Microsoft bash launcher with the \"-c\" flag.\nThis can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Bash/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_bash_command_execution.yml","techniques":["T1202"],"cves":[]},{"id":"6f1a11aa-4b8a-4b7f-9e13-4d3e4ff0e0d4","title":"WSL Kali-Linux Usage","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-10","modified":null,"description":"Detects the use of Kali Linux through Windows Subsystem for Linux","references":["https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e","https://learn.microsoft.com/en-us/windows/wsl/install"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_wsl_kali_linux_usage.yml","techniques":["T1202"],"cves":[]},{"id":"7530b96f-ad8e-431d-a04d-ac85cc461fdc","title":"Custom File Open Handler Executes PowerShell","author":"CD_R0M_","status":"test","level":"high","date":"2022-06-11","modified":"2023-08-17","description":"Detects the abuse of custom file open handler, executing powershell","references":["https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml","techniques":["T1202"],"cves":[]},{"id":"7530cd3d-7671-43e3-b209-976966f6ea48","title":"Renamed CURL.EXE Execution","author":"X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2023-09-11","modified":"2023-10-12","description":"Detects the execution of a renamed \"CURL.exe\" binary based on the PE metadata fields","references":["https://twitter.com/Kostastsale/status/1700965142828290260"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_renamed_curl.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"762bb580-79b4-40f4-8b9e-9349ce1710f4","title":"Indirect Command Execution via SFTP ProxyCommand","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-04-27","modified":null,"description":"Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.\nThreat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Sftp/","https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_sftp_proxy_command_execution.yml","techniques":["T1202"],"cves":[]},{"id":"7cce6fc8-a07f-4d84-a53e-96e1879843c9","title":"Potential Binary Impersonating Sysinternals Tools","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2021-12-20","modified":"2025-04-12","description":"Detects binaries that use the same name as legitimate sysinternals tools to evade detection.\nThis rule looks for the execution of binaries that are named similarly to Sysinternals tools.\nAdversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.\n","references":["https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202","attack.t1036.005"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml","techniques":["T1218","T1202","T1036.005"],"cves":[]},{"id":"7dc2dedd-7603-461a-bc13-15803d132355","title":"Uncommon Child Process Of Conhost.EXE","author":"omkar72","status":"test","level":"medium","date":"2020-10-25","modified":"2023-12-11","description":"Detects uncommon \"conhost\" child processes. This could be a sign of \"conhost\" usage as a LOLBIN or potential process injection activity.","references":["http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml","techniques":["T1202"],"cves":[]},{"id":"811f459f-9231-45d4-959a-0266c6311987","title":"Suspicious Child Process Of BgInfo.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-16","modified":null,"description":"Detects suspicious child processes of \"BgInfo.exe\" which could be a sign of potential abuse of the binary to proxy execution via external VBScript","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/","https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml","techniques":["T1059.005","T1218","T1202"],"cves":[]},{"id":"835e75bf-4bfd-47a4-b8a6-b766cac8bcb7","title":"Uncommon Child Process Of Setres.EXE","author":"@gott_cyber, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-11","modified":"2024-06-26","description":"Detects uncommon child process of Setres.EXE.\nSetres.EXE is a Windows server only process and tool that can be used to set the screen resolution.\nIt can potentially be abused in order to launch any arbitrary file with a name containing the word \"choice\" from the current execution path.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Setres/","https://twitter.com/0gtweet/status/1583356502340870144","https://strontic.github.io/xcyclopedia/library/setres.exe-0E30E4C09637D7A128A37B59A3BC4D09.html","https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_setres_uncommon_child_process.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"883faa95-175a-4e22-8181-e5761aeb373c","title":"Suspicious Service Binary Directory","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-03-09","modified":"2022-10-09","description":"Detects a service binary running in a suspicious directory","references":["https://blog.truesec.com/2021/03/07/exchange-zero-day-proxylogon-and-hafnium/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_susp_service_dir.yml","techniques":["T1202"],"cves":[]},{"id":"90dcf730-1b71-4ae7-9ffc-6fcf62bd0132","title":"Suspicious ZipExec Execution","author":"frack113","status":"test","level":"medium","date":"2021-11-07","modified":"2022-12-25","description":"ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.","references":["https://twitter.com/SBousseaden/status/1451237393017839616","https://github.com/Tylous/ZipExec"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_hktl_zipexec.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"aaf46cdc-934e-4284-b329-34aa701e3771","title":"Uncommon Child Process Of BgInfo.EXE","author":"Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community","status":"test","level":"medium","date":"2019-10-26","modified":"2023-08-16","description":"Detects uncommon child processes of \"BgInfo.exe\" which could be a sign of potential abuse of the binary to proxy execution via external VBScript","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/","https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml","techniques":["T1059.005","T1218","T1202"],"cves":[]},{"id":"c4e49831-1496-40cf-8ce1-b53f942b02f9","title":"Renamed PAExec Execution","author":"Florian Roth (Nextron Systems), Jason Lynch","status":"test","level":"high","date":"2021-05-22","modified":"2024-11-23","description":"Detects execution of renamed version of PAExec. Often used by attackers","references":["https://www.poweradmin.com/paexec/","https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_renamed_paexec.yml","techniques":["T1202"],"cves":[]},{"id":"d7c75059-2901-4578-b209-8837fd31c6a8","title":"Proxy Execution via Vshadow","author":"David Faiss","status":"experimental","level":"medium","date":"2025-05-26","modified":null,"description":"Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits.\nVShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag,\nattackers can leverage this parameter to proxy the execution of malware.\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/","https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_vshadow_exec.yml","techniques":["T1202"],"cves":[]},{"id":"dc4576d4-7467-424f-9eee-fd2b02855fe0","title":"Suspicious Cabinet File Execution Via Msdt.EXE","author":"Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113","status":"test","level":"medium","date":"2022-06-21","modified":"2024-03-13","description":"Detects execution of msdt.exe using the \"cab\" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190","references":["https://twitter.com/nas_bench/status/1537896324837781506","https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0","https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml","techniques":["T1202"],"cves":[]},{"id":"dec44ca7-61ad-493c-bfd7-8819c5faa09b","title":"Arbitrary Command Execution Using WSL","author":"oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-10-05","modified":"2023-04-12","description":"Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/","https://twitter.com/nas_bench/status/1535431474429808642"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_wsl_arbitrary_command_execution.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"dfa03a09-8b92-4d83-8e74-f72839b1c407","title":"Potentially Suspicious Child Processes Spawned by ConHost","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-02-05","modified":null,"description":"Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.","references":["https://tria.ge/241015-l98snsyeje/behavioral2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml","techniques":["T1202","T1218"],"cves":[]},{"id":"e212d415-0e93-435f-9e1a-f29005bb4723","title":"Suspicious Remote Child Process From Outlook","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2018-12-27","modified":"2023-02-09","description":"Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).","references":["https://github.com/sensepost/ruler","https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html","https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"ec8c4047-fad9-416a-8c81-0f479353d7f6","title":"Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE","author":"Greg (rule)","status":"test","level":"high","date":"2022-06-17","modified":"2023-02-17","description":"Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the \"sdiageng.dll\" library","references":["https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.stealth","attack.t1202","cve.2022-30190"],"path":"rules/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml","techniques":["T1202"],"cves":["CVE-2022-30190"]},{"id":"eca49c87-8a75-4f13-9c73-a5a29e845f03","title":"Suspicious Runscripthelper.exe","author":"Victor Sergeev, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2022-07-11","description":"Detects execution of powershell scripts via Runscripthelper.exe","references":["https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml","techniques":["T1059","T1202"],"cves":[]},{"id":"ed825c86-c009-4014-b413-b76003e33d35","title":"Windows Binary Executed From WSL","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-14","modified":null,"description":"Detects the execution of Windows binaries from within a WSL instance.\nThis could be used to masquerade parent-child relationships\n","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_wsl_windows_binaries_execution.yml","techniques":["T1202"],"cves":[]},{"id":"f37aba28-a9e6-4045-882c-d5004043b337","title":"Potential Arbitrary File Download Via Cmdl32.EXE","author":"frack113","status":"test","level":"medium","date":"2021-11-03","modified":"2024-04-22","description":"Detects execution of Cmdl32 with the \"/vpn\" and \"/lan\" flags.\nAttackers can abuse this utility in order to download arbitrary files via a configuration file.\nInspect the location and the content of the file passed as an argument in order to determine if it is suspicious.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/","https://twitter.com/SwiftOnSecurity/status/1455897435063074824","https://github.com/LOLBAS-Project/LOLBAS/pull/151"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"f7375e28-5c14-432f-b8d1-1db26c832df3","title":"Potential Arbitrary DLL Load Using Winword","author":"Victor Sergeev, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2023-03-29","description":"Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.","references":["https://github.com/D4Vinci/One-Lin3r/blob/9fdfa5f0b9c698dfbd4cdfe7d2473192777ae1c6/one_lin3r/core/liners/windows/cmd/dll_loader_word.py"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_office_winword_dll_load.yml","techniques":["T1202"],"cves":[]},{"id":"f99abdf0-6283-4e71-bd2b-b5c048a94743","title":"Potentially Suspicious Office Document Executed From Trusted Location","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-06-21","modified":"2023-10-18","description":"Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.","references":["Internal Research","https://twitter.com/Max_Mal_/status/1633863678909874176","https://techcommunity.microsoft.com/t5/microsoft-365-blog/new-security-hardening-policies-for-trusted-documents/ba-p/3023465","https://twitter.com/_JohnHammond/status/1588155401752788994"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml","techniques":["T1202"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-24919","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-40044","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-32315","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-29464","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2013-0629","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2019-3398","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2019-3396","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-3452","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2018-0296","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}