T1202 Indirect Command Execution

Technique: T1202
Tactics: Defense Evasion
Research, 90 days: 0
KEV CVEs mapped: 9
SigmaHQ rules: 40
Elastic, Splunk: 19
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1202

MITRE description

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts.(Citation: VectorSec ForFiles Aug 2017)(Citation: Evi1cg Forfiles Nov 2017)(Citation: Secure Team - Scriptrunner.exe)(Citation: SS64)(Citation: Bleeping Computer - Scriptrunner.exe) Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file.(Citation: Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot) Adversaries may abuse these features for [Stealth](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Detection coverage

SigmaHQ community rules

Arbitrary Command Execution Using WSL (threat-hunting)
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE (core)
Troubleshooting Pack Cmdlet Execution (core)
Indirect Inline Command Execution Via Bash.EXE (core)
Indirect Command Execution From Script File Via Bash.EXE (core)
Suspicious Child Process Of BgInfo.EXE (core)
Uncommon Child Process Of BgInfo.EXE (core)
Potential Arbitrary File Download Via Cmdl32.EXE (core)
Suspicious High IntegrityLevel Conhost Legacy Option (core)
Uncommon Child Process Of Conhost.EXE (core)
Potentially Suspicious Child Processes Spawned by ConHost (core)
Findstr Launching .lnk File (core)
Potential Arbitrary Command Execution Via FTP.EXE (core)
Suspicious ZipExec Execution (core)
Suspicious Runscripthelper.exe (core)
Potential Arbitrary Command Execution Using Msdt.EXE (core)
Suspicious Cabinet File Execution Via Msdt.EXE (core)
Potential Arbitrary File Download Using Office Application (core)
Potentially Suspicious Office Document Executed From Trusted Location (core)
Outlook EnableUnsafeClientMailRules Setting Enabled (core)
Suspicious Remote Child Process From Outlook (core)
Potential Arbitrary DLL Load Using Winword (core)
Renamed CURL.EXE Execution (core)
Renamed ZOHO Dctask64 Execution (core)
Renamed FTP.EXE Execution (core)

Showing 25 of 40 community rules. the full set is tagged attack.t1202 in SigmaHQ.

Elastic and Splunk rules

Curl or Wget Egress Network Connection via LoLBin (elastic)
System Binary Symlink to Suspicious Location (elastic)
Privilege Escalation via Parallels Appliance Extract Argument Injection (elastic)
Proxy Execution via Console Window Host (elastic)
Command Execution via ForFiles (elastic)
Proxy Execution via Windows OpenSSH (elastic)
Suspicious Execution via Windows Subsystem for Linux (elastic)
Execution via Windows Subsystem for Linux (elastic)
Windows Subsystem for Linux Enabled via Dism Utility (elastic)
Host File System Changes via Windows Subsystem for Linux (elastic)
Attempt to Install or Run Kali Linux via WSL (elastic)
Windows Subsystem for Linux Distribution Installed (elastic)
Indirect Command Execution via Forfiles/Pcalua (elastic)
Microsoft Intune Device Health Scripts (splunk)
Windows Content Copied from Browser was Executed (splunk)
Windows Indirect Command Execution Via forfiles (splunk)
Windows Indirect Command Execution Via pcalua (splunk)
Windows Indirect Command Execution Via Series Of Forfiles (splunk)
Windows RunMRU Command Execution (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.