MITRE ATT&CK technique
Indirect Command Execution detection rulesT1202
Indirect Command Execution (T1202) is a MITRE ATT&CK technique in the Stealth tactic. This page lists the 40 community-maintained Sigma detection rules in the library mapped to T1202 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Custom File Open Handler Executes PowerShell
highDetects the abuse of custom file open handler, executing powershell
windows · registry_set
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE
highDetects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library
windows · image_load
Outlook EnableUnsafeClientMailRules Setting Enabled
highDetects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
windows · process_creation
Potential Arbitrary Command Execution Using Msdt.EXE
highDetects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability
windows · process_creation
Potential Arbitrary File Download Using Office Application
highDetects potential arbitrary file download using a Microsoft Office application
windows · process_creation
Potentially Suspicious Child Processes Spawned by ConHost
highDetects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.
windows · process_creation
Potentially Suspicious Office Document Executed From Trusted Location
highDetects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.
windows · process_creation
Renamed NirCmd.EXE Execution
highDetects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
windows · process_creation
Renamed PAExec Execution
highDetects execution of renamed version of PAExec. Often used by attackers
windows · process_creation
Renamed PingCastle Binary Execution
highDetects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
windows · process_creation
Renamed ZOHO Dctask64 Execution
highDetects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.
windows · process_creation
Rundll32 Execution Without CommandLine Parameters
highDetects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity
windows · process_creation
Suspicious Child Process Of BgInfo.EXE
highDetects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
windows · process_creation
Suspicious Remote Child Process From Outlook
highDetects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
windows · process_creation
Suspicious Service Binary Directory
highDetects a service binary running in a suspicious directory
windows · process_creation
Suspicious Splwow64 Without Params
highDetects suspicious Splwow64.exe process without any command line parameters
windows · process_creation
Uncommon Child Process Of Setres.EXE
highDetects uncommon child process of Setres.EXE. Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution. It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path.
windows · process_creation
WSL Kali-Linux Usage
highDetects the use of Kali Linux through Windows Subsystem for Linux
windows · process_creation
Arbitrary Command Execution Using WSL
mediumDetects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
windows · process_creation
Findstr Launching .lnk File
mediumDetects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack
windows · process_creation
Indirect Command Execution From Script File Via Bash.EXE
mediumDetects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.
windows · process_creation
Indirect Command Execution via SFTP ProxyCommand
mediumDetects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter. Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.
windows · process_creation
Indirect Inline Command Execution Via Bash.EXE
mediumDetects execution of Microsoft bash launcher with the "-c" flag. This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.
windows · process_creation
Potential Arbitrary Command Execution Via FTP.EXE
mediumDetects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
windows · process_creation
Potential Arbitrary DLL Load Using Winword
mediumDetects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.
windows · process_creation
Potential Arbitrary File Download Via Cmdl32.EXE
mediumDetects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.
windows · process_creation
Potential Binary Impersonating Sysinternals Tools
mediumDetects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.
windows · process_creation
Potentially Suspicious Child Process Of VsCode
mediumDetects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
windows · process_creation
Proxy Execution via Vshadow
mediumDetects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits. VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag, attackers can leverage this parameter to proxy the execution of malware.
windows · process_creation
Renamed CURL.EXE Execution
mediumDetects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
windows · process_creation
Renamed FTP.EXE Execution
mediumDetects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
windows · process_creation
Suspicious Cabinet File Execution Via Msdt.EXE
mediumDetects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190
windows · process_creation
Suspicious Runscripthelper.exe
mediumDetects execution of powershell scripts via Runscripthelper.exe
windows · process_creation
Suspicious ZipExec Execution
mediumZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
windows · process_creation
Troubleshooting Pack Cmdlet Execution
mediumDetects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS)
windows · ps_script
Uncommon Child Process Of BgInfo.EXE
mediumDetects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
windows · process_creation
Uncommon Child Process Of Conhost.EXE
mediumDetects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.
windows · process_creation
Windows Binary Executed From WSL
mediumDetects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships
windows · process_creation
WSL Child Process Anomaly
mediumDetects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL
windows · process_creation
Suspicious High IntegrityLevel Conhost Legacy Option
informationalForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
windows · process_creation