Windows indirection utility spawning a scripting or download tool

Siemphony@siemphonymediumT1202unverified

Steps 1 and 2 of AN0576's chain in a single event: a process creation whose parent is one of the Windows utilities that exist to launch something else — forfiles.exe, pcalua.exe, ScriptRunner.exe — and whose own image is one of the interpreters, proxy binaries and downloaders that indirection is used to reach. That child list is MITRE's `HighRiskChildren` knob, populated here with its named entries plus wscript, cscript and certutil. A second, independent selection covers the ssh.exe variant the technique text describes: `ProxyCommand` and `LocalCommand` make ssh.exe execute a local command, and both appear literally on the command line when passed with -o. wsl.exe is named by both MITRE and the analytic and is deliberately absent. A command run through WSL executes inside the Linux VM and never surfaces as a Windows process creation, so the parent/child pair cannot fire for it; the only remaining option would be matching wsl.exe's own command line, which on a developer workstation is ordinary daily use. The ssh.exe selection has the mirror-image weakness: an operator who writes ProxyCommand or LocalCommand into %USERPROFILE%\.ssh\config instead of passing -o leaves nothing on the command line, and catching that needs the file-access leg of the analytic on a separate logsource. The rest of AN0576 is out of reach here. Step 3 — the SSH config write — and the network connections from the utility or its child are different events on different logsources, and the analytic's `TimeWindow` knob for correlating them is a join Sigma cannot express; `DestCIDRs` and `UserContext` are likewise post-hoc filters rather than literals. Prerequisite: the brief maps this to Sysmon EventID 1, so the fields are Sysmon's, and the rule sees nothing unless Sysmon is installed with a configuration that does not exclude these images from process creation. A Security 4688 feed needs the field names remapped (NewProcessName / ParentProcessName), plus Audit Process Creation and the separate command-line policy for the ssh.exe selection to have anything to read. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0200, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((InitiatingProcessFolderPath endswith "\\forfiles.exe" or InitiatingProcessFolderPath endswith "\\pcalua.exe" or InitiatingProcessFolderPath endswith "\\scriptrunner.exe") and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\msiexec.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\certutil.exe")) or (FolderPath endswith "\\ssh.exe" and (ProcessCommandLine contains "ProxyCommand" or ProcessCommandLine contains "LocalCommand")))

Splunk · SPL

Run this as a search.

index=* (((ParentImage="*\\forfiles.exe" OR ParentImage="*\\pcalua.exe" OR ParentImage="*\\scriptrunner.exe") AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\msiexec.exe" OR Image="*\\curl.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\certutil.exe")) OR (Image="*\\ssh.exe" AND (CommandLine="*ProxyCommand*" OR CommandLine="*LocalCommand*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.parent.executable) LIKE "*\\\\forfiles.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\pcalua.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\scriptrunner.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\msiexec.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe")) OR (TO_LOWER(process.executable) LIKE "*\\\\ssh.exe" AND (TO_LOWER(process.command_line) LIKE "*proxycommand*" OR TO_LOWER(process.command_line) LIKE "*localcommand*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\forfiles\.exe$|\\pcalua\.exe$|\\scriptrunner\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\msiexec\.exe$|\\curl\.exe$|\\bitsadmin\.exe$|\\certutil\.exe$)</field>    <description>Windows indirection utility spawning a scripting or download tool (1/2)</description>    <mitre>      <id>T1202</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\ssh\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(ProxyCommand|LocalCommand)</field>    <description>Windows indirection utility spawning a scripting or download tool (2/2)</description>    <mitre>      <id>T1202</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 6a33dcce-199f-4195-a4ea-03c30555b867

ATT&CKT1202

T1202Indirect Command Execution

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxyAI draft — unreviewed

01 · What this rule detects

Steps 1 and 2 of AN0576's chain, compressed into a single event. The rule fires when a process creation has one of the Windows indirection utilities as its parent — forfiles.exe, pcalua.exe, scriptrunner.exe — and its own image is an interpreter, proxy binary or downloader. A second, independent selection covers the ssh.exe variant the technique text names: ProxyCommand and LocalCommand make ssh execute a local command, and both appear literally on the command line when passed with -o.

02 · Telemetry you need

category: process_creation, product: windows, mapped by the brief to Sysmon EventID 1 — so the field names are Sysmon's (Image, ParentImage, CommandLine). The rule sees nothing unless Sysmon is installed with a configuration that does not exclude these images from process creation. On a Security 4688 feed the field names must be remapped to NewProcessName and ParentProcessName, and 4688 additionally needs Audit Process Creation; the ssh.exe selection needs the separate Include command line in process creation events policy on top of that, or CommandLine is simply absent.

03 · How the logic works

The child list is MITRE's HighRiskChildren knob, populated here with its named entries plus wscript, cscript and certutil, which are the pipeline's own additions. wsl.exe is named by both MITRE and the analytic and is deliberately absent: a command run through WSL executes inside the Linux VM and never surfaces as a Windows process creation, so the parent/child pair cannot fire for it, and matching wsl.exe's own command line is ordinary daily use on a developer workstation. The rest of AN0576 is out of reach. Step 3, the SSH config write, and the outbound connections from the utility or its child are different events on different logsources, and the TimeWindow knob that would join them is a correlation Sigma cannot express. DestCIDRs and UserContext are likewise post-hoc filters, not literals you can put in a selection. Know the gap in the child gate before you trust it. forfiles does not route /c through cmd — it creates the process directly, and cmd appears only because the documented default is cmd /c echo @file. So forfiles /p C:\Windows\System32 /m notepad.exe /c "C:\Users\Public\evil.exe" produces a child not on the list and does not fire. The same holds for pcalua -a <any exe>. The arbitrary-EXE shape — the whole point of the technique — is the shape this rule misses.

04 · Common false positives

Scheduled log and cache pruning built on forfiles is the loudest source: the classic delete one-liner runs cmd.exe, on a fixed schedule, on every server that has one. App-V and MSIX packages published through ScriptRunner launch their own cmd or PowerShell scripts at publish, launch and removal. The Program Compatibility Assistant relaunches legacy installers through pcalua into msiexec. Any admin using an SSH ProxyCommand to reach a host through a jump box trips the third selection on every hop.

05 · Detection maturity

tier_1: . UNVERIFIED — derived from DET0200 and never executed against logs. The medium level matches the forfiles false positive being the dominant match.
tier_2: begins with measuring that volume on real endpoints.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by full parent command line, not by parent image — a scheduled-task forfiles line is fixed text and excludes cleanly, while \forfiles.exe alone removes the detection. That is MITRE's AllowedUtilities knob applied carefully. Move ProxyCommand users to a config file and allowlist the jump hosts. To close the arbitrary-EXE gap, alert on the indirection parent alone in user-writable child paths.

Declared by the author

Scheduled log and cache pruning built on forfiles.exe. Its /c argument is always executed through cmd.exe, so every run of the classic forfiles delete one-liner produces the parent/child pair this rule matches, on a fixed schedule, on every server that runs one.
App-V and MSIX packages published through ScriptRunner.exe, which launches the package's own cmd.exe or powershell.exe scripts at publish, launch and removal time on every machine the package is deployed to.
The Program Compatibility Assistant relaunching a legacy installer or shortcut through pcalua.exe, which then calls msiexec.exe to complete an entirely ordinary installation.
Administrators and developers reaching an internal host through a jump box with an SSH ProxyCommand entry, which puts the option on ssh.exe's command line on every single hop.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Indirect command execution
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1202, evaluated against their process_creation events.

Share this rule

/u/siemphony/6a33dcce-199f-4195-a4ea-03c30555b867

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Windows indirection utility spawning a scripting or download tool

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it