Liran Ravich, CardinalOps; Matthew Demaske, Adaptforward
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), Scriptrunner.exe, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts.[1][2][3][4][5] Adversaries may also abuse the ssh.exe binary to execute malicious commands via the ProxyCommand and LocalCommand options, which can be invoked via the -o flag or by modifying the SSH config file.[6]
Adversaries may abuse these features for Stealth, specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of cmd or file extensions more commonly associated with malicious payloads.
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Persistence mechanisms have used forfiles.exe to execute .htm files.1
created 2017-05-311 referenceaka Labyrinth Chollima
All 2 groups for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Indirect Command Execution – Windows utility abuse behavior chain
Enterprise
1 platform
AN0576 · Windows
Cause→effect chain: (1) A user or service launches an indirection utility (e.g., forfiles.exe, pcalua.exe, wsl.exe, scriptrunner.exe, ssh.exe with -o ProxyCommand/LocalCommand). (2) That utility spawns a secondary program/command (PowerShell, cmd, msiexec, regsvr32, curl, arbitrary EXE) and/or opens outbound network connections. (3) Optional precursor modification of SSH config to persist LocalCommand/ProxyCommand. Correlate process creation, command/script content, file access to %USERPROFILE%\.ssh\config, and network connections from the utility or its child.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Raise severity when the actor is a standard/interactive user on a workstation rather than a server or CI agent.
DestCIDRs
Known-good egress networks for SSH/WSL activity to suppress expected admin automations.
Tests5Executorscommand_prompt 3 · powershell 2Need elevation0 of 5Have prerequisites0Have cleanup0Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Indirect Command Execution - pcalua.exe
windows
command_prompt
—
—
—
The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface.
Reference
Upon execution, calc.exe should open
Inputs
Name
Description
Type
Default Value
process
Process to execute
string
calc.exe
payload_path
Path to payload
path
C:\Windows\System32\calc.exe
Attack Commandsrun with command_prompt
pcalua.exe -a #{process}
pcalua.exe -a #{payload_path}
GUIDcecfea7a-5f03-4cdd-8bc8-6f7c22862440
02
Indirect Command Execution - forfiles.exe
windows
command_prompt
—
—
—
forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface.
Reference
"This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe"
Upon execution calc.exe will be opened.
conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer.
Executing it through command line can create process ancestry anomalies
[Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)
Inputs
Name
Description
Type
Default Value
process
Process to execute
string
notepad.exe
Attack Commandsrun with command_prompt
conhost.exe "#{process}"
GUIDcf3391e0-b482-4b02-87fc-ca8362269b29
04
Indirect Command Execution - Scriptrunner.exe
windows
powershell
—
—
—
The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting. Upon test execution, calc.exe should open
Reference: https://x.com/NickTyrer/status/914234924655312896
Inputs
Name
Description
Type
Default Value
payload_path
Path to the executable
String
C:\Windows\System32\calc.exe
Attack Commandsrun with powershell
Scriptrunner.exe -appvscript "#{payload_path}"
GUID0fd14730-6226-4f5e-8d67-43c65f1be940
05
Indirect Command Execution - RunMRU Dialog
windows
powershell
—
—
—
Simulates execution of commands via the Windows Run dialog (Win+R) by programmatically opening the Run dialog,
copying a command to clipboard, and automating the paste and execution. This generates artifacts in the RunMRU registry key,
which is commonly abused by threat actors to execute malicious commands disguised as CAPTCHA verification steps.
Upon execution, a test PowerShell command will be executed through the Run dialog.
Inputs
Name
Description
Type
Default Value
command
Command to execute via Run dialog
string
calc.exe
Attack Commandsrun with powershell
# Copy command to clipboard
Set-Clipboard -Value '#{command}'
# Open Run dialog
Start-Process -FilePath "powershell" -ArgumentList "-c (New-Object -ComObject 'Shell.Application').FileRun()" -WindowStyle Hidden
# Wait for Run dialog to open
Start-Sleep -Seconds 1
# Paste command and execute
Add-Type -AssemblyName System.Windows.Forms
[System.Windows.Forms.SendKeys]::SendWait('^v')
Start-Sleep -Milliseconds 500
[System.Windows.Forms.SendKeys]::SendWait('{ENTER}')
Top 5%of all ATT&CK techniques for number of rules
Showing 1-48 of 48 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. (...)
Microsoft Intune supports deploying packaged applications to support software deployment, this functionality can also be abused for deploying malicious payloads to intune managed devices. (...)
Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.
Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits. (...)
The following analytic detects modifications to the Windows RunMRU registry key, which stores a history of commands executed through the Run dialog box (Windows+R). (...)