T1202 Indirect Command Execution
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (`pcalua.exe`),…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Custom File Open Handler Executes PowerShellhightest · windows
- Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXEhightest · windows
- Outlook EnableUnsafeClientMailRules Setting Enabledhightest · windows
- Potential Arbitrary Command Execution Using Msdt.EXEhightest · windows
- Potential Arbitrary File Download Using Office Applicationhightest · windows
- Potentially Suspicious Office Document Executed From Trusted Locationhightest · windows
- Renamed NirCmd.EXE Executionhightest · windows
- Renamed PAExec Executionhightest · windows
- Renamed PingCastle Binary Executionhightest · windows
- Renamed ZOHO Dctask64 Executionhightest · windows
- Rundll32 Execution Without CommandLine Parametershightest · windows
- Suspicious Child Process Of BgInfo.EXEhightest · windows
- Suspicious Remote Child Process From Outlookhightest · windows
- Suspicious Service Binary Directoryhightest · windows
- Suspicious Splwow64 Without Paramshightest · windows
- Uncommon Child Process Of Setres.EXEhightest · windows
- Potentially Suspicious Child Processes Spawned by ConHosthighexperimental · windows
- WSL Kali-Linux Usagehighexperimental · windows
- Findstr Launching .lnk Filemediumtest · windows
- Indirect Command Execution From Script File Via Bash.EXEmediumtest · windows
- Indirect Inline Command Execution Via Bash.EXEmediumtest · windows
- Potential Arbitrary Command Execution Via FTP.EXEmediumtest · windows
- Potential Arbitrary DLL Load Using Winwordmediumtest · windows
- Potential Arbitrary File Download Via Cmdl32.EXEmediumtest · windows
- Potential Binary Impersonating Sysinternals Toolsmediumtest · windows
Showing 25 of 38.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.