T1202 — Indirect Command Execution

Tactic: Stealth · Platforms: Windows

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant…

Sigma detection rules (1)

T1202 Indirect Command Execution

title: T1202 Indirect Command Execution
id: e875ea51-58a1-457a-84bf-11b81ae35c67
description: 'Detects execution of Windows utilities (forfiles.exe, pcalua.exe, scriptrunner.exe, wsl.exe, bash.exe) that can invoke command/script execution while bypassing direct cmd.exe/PowerShell invocation. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, AllowedUtilities, HighRiskChildren, UserContext, DestCIDRs.'
references:
  - https://attack.mitre.org/techniques/T1202
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.stealth
  - attack.t1202

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    Image|endswith:
      - '\forfiles.exe'
      - '\pcalua.exe'
      - '\scriptrunner.exe'
      - '\wsl.exe'
      - '\bash.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate administrative or scripted use of forfiles, pcalua, or WSL/bash by developers.

level: medium

Explore