T1202 Indirect Command Execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. MITRE ATT&CK

28 programs on CmdID 37 Sigma rules T1202 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first

highOutlook EnableUnsafeClientMailRules Setting EnabledMarkus Neis, Nasreddine Bencherchali (Nextron Systems) · Windows

highPotential Arbitrary Command Execution Using Msdt.EXENasreddine Bencherchali (Nextron Systems) · Windows

highPotential Arbitrary File Download Using Office ApplicationNasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community · Windows

highPotentially Suspicious Child Processes Spawned by ConHostSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highPotentially Suspicious Office Document Executed From Trusted LocationNasreddine Bencherchali (Nextron Systems) · Windows

highRenamed NirCmd.EXE ExecutionX__Junior (Nextron Systems) · Windows

highRenamed PAExec ExecutionFlorian Roth (Nextron Systems), Jason Lynch · Windows

highRenamed PingCastle Binary ExecutionNasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · Windows

highRenamed ZOHO Dctask64 ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

highRundll32 Execution Without CommandLine ParametersFlorian Roth (Nextron Systems) · Windows

highSuspicious Child Process Of BgInfo.EXENasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Remote Child Process From OutlookMarkus Neis, Nasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Service Binary DirectoryFlorian Roth (Nextron Systems) · Windows

highSuspicious Splwow64 Without ParamsFlorian Roth (Nextron Systems) · Windows

highUncommon Child Process Of Setres.EXE@gott_cyber, Nasreddine Bencherchali (Nextron Systems) · Windows

highWSL Kali-Linux UsageSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumArbitrary Command Execution Using WSLoscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumFindstr Launching .lnk FileTrent Liffick · Windows

mediumIndirect Command Execution From Script File Via Bash.EXENasreddine Bencherchali (Nextron Systems) · Windows

mediumIndirect Command Execution via SFTP ProxyCommandSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumIndirect Inline Command Execution Via Bash.EXEfrack113 · Windows

mediumPotential Arbitrary Command Execution Via FTP.EXEVictor Sergeev, oscd.community · Windows

mediumPotential Arbitrary DLL Load Using WinwordVictor Sergeev, oscd.community · Windows

mediumPotential Arbitrary File Download Via Cmdl32.EXEfrack113 · Windows

mediumPotential Binary Impersonating Sysinternals Toolsfrack113, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumPotentially Suspicious Child Process Of VsCodeNasreddine Bencherchali (Nextron Systems) · Windows

mediumProxy Execution via VshadowDavid Faiss · Windows

mediumRenamed CURL.EXE ExecutionX__Junior (Nextron Systems) · Windows

mediumRenamed FTP.EXE ExecutionVictor Sergeev, oscd.community · Windows

mediumSuspicious Cabinet File Execution Via Msdt.EXENasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113 · Windows

mediumSuspicious Runscripthelper.exeVictor Sergeev, oscd.community · Windows

mediumSuspicious ZipExec Executionfrack113 · Windows

mediumUncommon Child Process Of Conhost.EXEomkar72 · Windows

mediumUncommon Child Process Spawned From XBootMgrSleep.EXEDiablo Research · Windows

mediumWindows Binary Executed From WSLNasreddine Bencherchali (Nextron Systems) · Windows

mediumWSL Child Process AnomalyNasreddine Bencherchali (Nextron Systems) · Windows

informationalSuspicious High IntegrityLevel Conhost Legacy Optionfrack113 · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Execute specific commands on the page for bash.exe

bash -c "echo 'bash is executed'"Identify

Run a Linux command without using a shell on the page for wsl.exe

wsl --exec command command_argumentsIdentify

An example is here when CmdID’s reading of it names T1202: a Sigma rule it trips is tagged with it, or its abuse is documented as it.

T1202 Indirect Command Execution

Programs for it

Sigma rules tagged with it

Command lines CmdID reads as it