tfMITRE ATT&CK technique

Indirect Command Execution T1202

Tactic: Stealth
Platform: Windows
Version: 2.0
Created: 18 April 2018
Last modified: 12 May 2026
Contributors: Liran Ravich, CardinalOps; Matthew Demaske, Adaptforward

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), Scriptrunner.exe, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts.[1][2][3][4][5] Adversaries may also abuse the ssh.exe binary to execute malicious commands via the ProxyCommand and LocalCommand options, which can be invoked via the -o flag or by modifying the SSH config file.[6]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 5%

Detection rules95th percentile · 95% of ATT&CK techniques have this many detection rules written or fewer.

Indirect Command Execution MITRE reference T1202

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

RedCurlG1039 ↗

Has used pcalua.exe to obfuscate binary execution and remote connections.1

created 2024-09-231 reference

Lazarus GroupG0032 ↗

Persistence mechanisms have used forfiles.exe to execute .htm files.1

created 2017-05-311 referenceaka Labyrinth Chollima

All 2 groups for this technique

Offense vs defense T1202

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 40Splunk ESCU (cumulative) · 6

first rule: 2018 Q4

Indirect Command Execution detection strategy DET0200

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Indirect Command Execution – Windows utility abuse behavior chain

Enterprise

1 platform

AN0576 · Windows

Cause→effect chain: (1) A user or service launches an indirection utility (e.g., forfiles.exe, pcalua.exe, wsl.exe, scriptrunner.exe, ssh.exe with -o ProxyCommand/LocalCommand). (2) That utility spawns a secondary program/command (PowerShell, cmd, msiexec, regsvr32, curl, arbitrary EXE) and/or opens outbound network connections. (3) Optional precursor modification of SSH config to persist LocalCommand/ProxyCommand. Correlate process creation, command/script content, file access to %USERPROFILE%\.ssh\config, and network connections from the utility or its child.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window between indirect launcher and spawned child/network activity (e.g., 10–30 minutes).
AllowedUtilities	Utilities permitted on admin/Jumphosts (forfiles, wsl, ssh) to reduce noise.
HighRiskChildren	Child images that indicate abuse (powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, mshta.exe, msiexec.exe, curl.exe, bitsadmin.exe).
UserContext	Raise severity when the actor is a standard/interactive user on a workstation rather than a server or CI agent.
DestCIDRs	Known-good egress networks for SSH/WSL activity to suppress expected admin automations.

Tests5Executorscmd 3 · PowerShell 2Need elevation0 of 5Have prerequisites0Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Indirect Command Execution - pcalua.exe

windows

cmd

—

The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface. Reference Upon execution, calc.exe should open

Input arguments

Name	Type	Default	Description
process	string	calc.exe	Process to execute
payload_path	path	C:\Windows\System32\calc.exe	Path to payload

Attack command

pcalua.exe -a #{process}
pcalua.exe -a #{payload_path}

GUID4ed89137-5161-4fcc-81d4-784ac8308016

Indirect Command Execution - forfiles.exe

windows

cmd

—

forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface. Reference "This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe" Upon execution calc.exe will be opened.

Input arguments

Name	Type	Default	Description
process	string	calc.exe	Process to execute

Attack command

forfiles /p c:\windows\system32 /m notepad.exe /c #{process}

GUID7054e995-bb10-47b9-a9b1-be6e279c809d

Indirect Command Execution - conhost.exe

windows

cmd

—

conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer. Executing it through command line can create process ancestry anomalies [Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)

Input arguments

Name	Type	Default	Description
process	string	notepad.exe	Process to execute

Attack command

conhost.exe "#{process}"

GUID49813588-83b0-4f62-915d-3b657c54c864

Indirect Command Execution - Scriptrunner.exe

windows

PowerShell

—

The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting. Upon test execution, calc.exe should open Reference: https://x.com/NickTyrer/status/914234924655312896

Input arguments

Name	Type	Default	Description
payload_path	String	C:\Windows\System32\calc.exe	Path to the executable

Attack command

Scriptrunner.exe -appvscript "#{payload_path}"

GUID3dd28b4a-282a-4ec9-943d-11a8b032342e

Indirect Command Execution - RunMRU Dialog

windows

PowerShell

—

Simulates execution of commands via the Windows Run dialog (Win+R) by programmatically opening the Run dialog, copying a command to clipboard, and automating the paste and execution. This generates artifacts in the RunMRU registry key, which is commonly abused by threat actors to execute malicious commands disguised as CAPTCHA verification steps. Upon execution, a test PowerShell command will be executed through the Run dialog.

Input arguments

Name	Type	Default	Description
command	string	calc.exe	Command to execute via Run dialog

Attack command

# Copy command to clipboard
Set-Clipboard -Value '#{command}'

# Open Run dialog
Start-Process -FilePath "powershell" -ArgumentList "-c (New-Object -ComObject 'Shell.Application').FileRun()" -WindowStyle Hidden

# Wait for Run dialog to open
Start-Sleep -Seconds 1

# Paste command and execute
Add-Type -AssemblyName System.Windows.Forms
[System.Windows.Forms.SendKeys]::SendWait('^v')
Start-Sleep -Milliseconds 500
[System.Windows.Forms.SendKeys]::SendWait('{ENTER}')

GUIDeda76300-5948-4942-9451-5102578f44c2

Tests from Atomic Red Team (MIT licence) · technique definition

Indirect Command Execution detections T1202

46 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 5%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs