Indirect Command Execution From Script File Via Bash.EXE

Title: Indirect Command Execution From Script File Via Bash.EXE
Status: test
Description:Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Bash/
  -https://linux.die.net/man/1/bash
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-15
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1202'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    - Image|endswith:
      - ':\Windows\System32\bash.exe'
      - ':\Windows\SysWOW64\bash.exe'
OriginalFileName:'Bash.exe'   filter_main_cli_flag:
    CommandLine|contains:
      -'bash.exe -'
      -'bash -'

  filter_main_no_cli:
    CommandLine: 'None'
  filter_main_empty:
    CommandLine: ''
  filter_main_no_flag:
    CommandLine:
      -'bash.exe'
      -'bash'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium