Indirect Command Execution

T1202

About this technique

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts. Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file.

Adversaries may abuse these features for Stealth, specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of cmd or file extensions more commonly associated with malicious payloads.

Detection rules47

Rules on DetectionCode tagged with T1202.

Sigma40

Rule	Level	Log source
Custom File Open Handler Executes PowerShell	high	windows / registry_set
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE	high	windows / image_load
Outlook EnableUnsafeClientMailRules Setting Enabled	high	windows / process_creation
Potential Arbitrary Command Execution Using Msdt.EXE	high	windows / process_creation
Potential Arbitrary File Download Using Office Application	high	windows / process_creation
Potentially Suspicious Child Processes Spawned by ConHost	high	windows / process_creation
Potentially Suspicious Office Document Executed From Trusted Location	high	windows / process_creation
Renamed NirCmd.EXE Execution	high	windows / process_creation
Renamed PAExec Execution	high	windows / process_creation
Renamed PingCastle Binary Execution	high	windows / process_creation
Renamed ZOHO Dctask64 Execution	high	windows / process_creation
Rundll32 Execution Without CommandLine Parameters	high	windows / process_creation
Suspicious Child Process Of BgInfo.EXE	high	windows / process_creation
Suspicious Remote Child Process From Outlook	high	windows / process_creation
Suspicious Service Binary Directory	high	windows / process_creation
Suspicious Splwow64 Without Params	high	windows / process_creation
Uncommon Child Process Of Setres.EXE	high	windows / process_creation
WSL Kali-Linux Usage	high	windows / process_creation
Findstr Launching .lnk File	medium	windows / process_creation
Indirect Command Execution From Script File Via Bash.EXE	medium	windows / process_creation
Indirect Command Execution via SFTP ProxyCommand	medium	windows / process_creation
Indirect Inline Command Execution Via Bash.EXE	medium	windows / process_creation
Potential Arbitrary Command Execution Via FTP.EXE	medium	windows / process_creation
Potential Arbitrary DLL Load Using Winword	medium	windows / process_creation
Potential Arbitrary File Download Via Cmdl32.EXE	medium	windows / process_creation
Potential Binary Impersonating Sysinternals Tools	medium	windows / process_creation
Potentially Suspicious Child Process Of VsCode	medium	windows / process_creation
Proxy Execution via Vshadow	medium	windows / process_creation
Renamed CURL.EXE Execution	medium	windows / process_creation
Renamed FTP.EXE Execution	medium	windows / process_creation
Suspicious Cabinet File Execution Via Msdt.EXE	medium	windows / process_creation
Suspicious Runscripthelper.exe	medium	windows / process_creation
Suspicious ZipExec Execution	medium	windows / process_creation
Troubleshooting Pack Cmdlet Execution	medium	windows / ps_script
Uncommon Child Process Of BgInfo.EXE	medium	windows / process_creation
Uncommon Child Process Of Conhost.EXE	medium	windows / process_creation
Uncommon Child Process Spawned From XBootMgrSleep.EXE	medium	windows / process_creation
Windows Binary Executed From WSL	medium	windows / process_creation
WSL Child Process Anomaly	medium	windows / process_creation
Suspicious High IntegrityLevel Conhost Legacy Option	informational	windows / process_creation

Splunk7

Rule	Type	Risk	Data source
Microsoft Intune Device Health Scripts	Hunting	NULL	Azure Monitor Activity
Microsoft Intune Mobile Apps	Hunting	NULL	Azure Monitor Activity
Windows Content Copied from Browser was Executed	TTP	NULL	Sysmon EventID 13 AND Sysmon EventID 24
Windows Indirect Command Execution Via forfiles	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Indirect Command Execution Via pcalua	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
Windows Indirect Command Execution Via Series Of Forfiles	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows RunMRU Command Execution	Anomaly	NULL	Sysmon EventID 13

Groups2

Lazarus Group RedCurl

Software2

Forfiles Revenge RAT

Campaigns0

None recorded.

Procedure examples4

Groups2

Used by	Procedure example
GroupLazarus Group	Lazarus Group persistence mechanisms have used `forfiles.exe` to execute .htm files. Qualys LolZarus
GroupRedCurl	RedCurl has used pcalua.exe to obfuscate binary execution and remote connections. trendmicro_redcurl

Software2

Used by	Procedure example
ToolForfiles	Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd. Evi1cg Forfiles Nov 2017 VectorSec ForFiles Aug 2017
MalwareRevenge RAT	Revenge RAT uses the Forfiles utility to execute commands on the system. Cofense RevengeRAT Feb 2019

References6

Bleeping Computer - Scriptrunner.exe Open source
Bill Toulas. (2023, January 4). Hackers abuse Windows error reporting tool to deploy malware. Retrieved July 8, 2024.
Evi1cg Forfiles Nov 2017 Open source
Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved September 12, 2024.
SS64 Open source
SS64. (n.d.). ScriptRunner.exe. Retrieved July 8, 2024.
Secure Team - Scriptrunner.exe Open source
Secure Team - Information Assurance. (2023, January 8). Windows Error Reporting Tool Abused to Load Malware. Retrieved July 8, 2024.
Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot Open source
Cyble. (2024, December 5). Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot. Retrieved February 4, 2025.
VectorSec ForFiles Aug 2017 Open source
vector_sec. (2017, August 11). Defenders watching launches of cmd? What about forfiles?. Retrieved September 12, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.