Techniques › T1202 › AN0576
AN0576 Analytic 0576
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Cause→effect chain: (1) A user or service launches an indirection utility (e.g., forfiles.exe, pcalua.exe, wsl.exe, scriptrunner.exe, ssh.exe with -o ProxyCommand/LocalCommand). (2) That utility spawns a secondary program/command (PowerShell, cmd, msiexec, regsvr32, curl, arbitrary EXE) and/or opens outbound network connections. (3) Optional precursor modification of SSH config to persist LocalCommand/ProxyCommand. Correlate process creation, command/script content, file access to %USERPROFILE%\.ssh\config, and network connections from the utility or its child.</p>
- Detects
- T1202 Indirect Command Execution
- Part of
- DET0200 Indirect Command Execution – Windows utility abuse behavior chain
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation window between indirect launcher and spawned child/network activity (e.g., 10–30 minutes). |
AllowedUtilities | Utilities permitted on admin/Jumphosts (forfiles, wsl, ssh) to reduce noise. |
HighRiskChildren | Child images that indicate abuse (powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, mshta.exe, msiexec.exe, curl.exe, bitsadmin.exe). |
UserContext | Raise severity when the actor is a standard/interactive user on a workstation rather than a server or CI agent. |
DestCIDRs | Known-good egress networks for SSH/WSL activity to suppress expected admin automations. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2013-0629 | Adobe ColdFusion | Mapped |
| CVE-2018-0296 | Cisco Adaptive Security Appliance (ASA) | Mapped |
| CVE-2019-3396 | Atlassian Confluence Server and Data Server | Mapped |
| CVE-2019-3398 | Atlassian Confluence Server and Data Center | Mapped |
| CVE-2020-3452 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Mapped |
| CVE-2022-29464 | WSO2 Multiple Products | Mapped |
| CVE-2023-32315 | Ignite Realtime Openfire | Mapped |
| CVE-2023-40044 | Progress WS_FTP Server | Mapped |
| CVE-2024-24919 | Check Point Quantum Security Gateways | Mapped |