Skip to content
Atomic Red Team
atomics
T1202

T1202 - Indirect Command Execution

Description from ATT&CK (opens in a new tab)

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd (opens in a new tab). For example, Forfiles (opens in a new tab), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), Scriptrunner.exe, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter (opens in a new tab), Run window, or via scripts.(Citation: VectorSec ForFiles Aug 2017)(Citation: Evi1cg Forfiles Nov 2017)(Citation: Secure Team - Scriptrunner.exe)(Citation: SS64)(Citation: Bleeping Computer - Scriptrunner.exe) Adversaries may also abuse the ssh.exe binary to execute malicious commands via the ProxyCommand and LocalCommand options, which can be invoked via the -o flag or by modifying the SSH config file.(Citation: Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot)

Adversaries may abuse these features for Defense Evasion (opens in a new tab), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of cmd (opens in a new tab) or file extensions more commonly associated with malicious payloads.

Atomic Tests


Atomic Test #1 - Indirect Command Execution - pcalua.exe

The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface. Reference (opens in a new tab) Upon execution, calc.exe should open

Supported Platforms: Windows

auto_generated_guid: cecfea7a-5f03-4cdd-8bc8-6f7c22862440

Inputs:

NameDescriptionTypeDefault Value
payload_pathPath to payloadpathC:\Windows\System32\calc.exe
processProcess to executestringcalc.exe

Attack Commands: Run with command_prompt!

pcalua.exe -a #{process}
pcalua.exe -a #{payload_path}


Atomic Test #2 - Indirect Command Execution - forfiles.exe

forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface. Reference (opens in a new tab) "This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe" Upon execution calc.exe will be opened.

Supported Platforms: Windows

auto_generated_guid: 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc

Inputs:

NameDescriptionTypeDefault Value
processProcess to executestringcalc.exe

Attack Commands: Run with command_prompt!

forfiles /p c:\windows\system32 /m notepad.exe /c #{process}


Atomic Test #3 - Indirect Command Execution - conhost.exe

conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer. Executing it through command line can create process ancestry anomalies [Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/ (opens in a new tab))

Supported Platforms: Windows

auto_generated_guid: cf3391e0-b482-4b02-87fc-ca8362269b29

Inputs:

NameDescriptionTypeDefault Value
processProcess to executestringnotepad.exe

Attack Commands: Run with command_prompt!

conhost.exe "#{process}"


Atomic Test #4 - Indirect Command Execution - Scriptrunner.exe

The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting. Upon test execution, calc.exe should open Reference: https://x.com/NickTyrer/status/914234924655312896 (opens in a new tab)

Supported Platforms: Windows

auto_generated_guid: 0fd14730-6226-4f5e-8d67-43c65f1be940

Inputs:

NameDescriptionTypeDefault Value
payload_pathPath to the executableStringC:\Windows\System32\calc.exe

Attack Commands: Run with powershell!

Scriptrunner.exe -appvscript "#{payload_path}"


Atomic Test #5 - Indirect Command Execution - RunMRU Dialog

Simulates execution of commands via the Windows Run dialog (Win+R) by programmatically opening the Run dialog, copying a command to clipboard, and automating the paste and execution. This generates artifacts in the RunMRU registry key, which is commonly abused by threat actors to execute malicious commands disguised as CAPTCHA verification steps. Upon execution, a test PowerShell command will be executed through the Run dialog.

Supported Platforms: Windows

auto_generated_guid: de323a93-2f18-4bd5-ba60-d6fca6aeff76

Inputs:

NameDescriptionTypeDefault Value
commandCommand to execute via Run dialogstringcalc.exe

Attack Commands: Run with powershell!

# Copy command to clipboard
Set-Clipboard -Value '#{command}'
 
# Open Run dialog
Start-Process -FilePath "powershell" -ArgumentList "-c (New-Object -ComObject 'Shell.Application').FileRun()" -WindowStyle Hidden
 
# Wait for Run dialog to open
Start-Sleep -Seconds 1
 
# Paste command and execute
Add-Type -AssemblyName System.Windows.Forms
[System.Windows.Forms.SendKeys]::SendWait('^v')
Start-Sleep -Milliseconds 500
[System.Windows.Forms.SendKeys]::SendWait('{ENTER}')

T1201T1204.002