kevmap

Techniques › T1059

T1059 Command and Scripting Interpreter

execution — Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
5
analytics
95
Sigma rules tagged attack.t1059
170
KEV CVEs mapped here
<p>Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.</p><p>There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.</p><p>Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVEVendor / productMapping typeStateAdded
CVE-2023-2533PaperCut NG/MF primary impact Mapped2025-07-28
CVE-2025-20337Cisco Identity Services Engine primary impact Mapped2025-07-28
CVE-2025-20281Cisco Identity Services Engine primary impact Mapped2025-07-28
CVE-2025-53770Microsoft SharePoint exploitation technique Mapped2025-07-20
CVE-2025-47812Wing FTP Server Wing FTP Server primary impact Mapped2025-07-14
CVE-2025-6554Google Chromium V8 primary impact Mapped2025-07-02
CVE-2025-6543Citrix NetScaler ADC and Gateway secondary impact Mapped2025-06-30
CVE-2023-33538TP-Link Multiple Routers primary impact Mapped2025-06-16
CVE-2025-33053Microsoft Windows primary impact Mapped2025-06-10
CVE-2025-24016Wazuh Wazuh Server primary impact Mapped2025-06-10
CVE-2025-32433Erlang Erlang/OTP primary impact Mapped2025-06-09
CVE-2025-27038Qualcomm Multiple Chipsets primary impact Mapped2025-06-03
CVE-2025-3935ConnectWise ScreenConnect primary impact Mapped2025-06-02
CVE-2025-35939Craft CMS Craft CMS secondary impact Mapped2025-06-02
CVE-2024-56145Craft CMS Craft CMS primary impact Mapped2025-06-02
CVE-2025-4632Samsung MagicINFO 9 Server primary impact Mapped2025-05-22
CVE-2024-11182MDaemon Email Server primary impact Mapped2025-05-19
CVE-2025-4428Ivanti Endpoint Manager Mobile (EPMM) primary impact Mapped2025-05-19
CVE-2025-4427Ivanti Endpoint Manager Mobile (EPMM) primary impact Mapped2025-05-19
CVE-2025-42999SAP NetWeaver primary impact Mapped2025-05-15
CVE-2024-12987DrayTek Vigor Routers primary impact Mapped2025-05-15
CVE-2025-32756Fortinet Multiple Products primary impact Mapped2025-05-14
CVE-2025-32709Microsoft Windows primary impact Mapped2025-05-13
CVE-2025-30397Microsoft Windows primary impact Mapped2025-05-13
CVE-2025-32706Microsoft Windows exploitation technique Mapped2025-05-13
CVE-2025-32701Microsoft Windows exploitation technique Mapped2025-05-13
CVE-2024-6047GeoVision Multiple Devices primary impact Mapped2025-05-07
CVE-2025-3248Langflow Langflow primary impact Mapped2025-05-05
CVE-2024-58136Yiiframework Yii primary impact Mapped2025-05-02
CVE-2024-38475Apache HTTP Server primary impact Mapped2025-05-01
CVE-2025-31324SAP NetWeaver primary impact Mapped2025-04-29
CVE-2025-1976Broadcom Brocade Fabric OS primary impact Mapped2025-04-28
CVE-2025-42599Qualitia Active! Mail primary impact Mapped2025-04-28
CVE-2025-3928Commvault Web Server primary impact Mapped2025-04-28
CVE-2025-31201Apple Multiple Products secondary impact Stale2025-04-17
CVE-2025-31200Apple Multiple Products secondary impact Stale2025-04-17
CVE-2021-20035SonicWall SMA100 Appliances exploitation technique Mapped2025-04-16
CVE-2024-53197Linux Kernel primary impact Mapped2025-04-09
CVE-2025-30406Gladinet CentreStack primary impact Mapped2025-04-08
CVE-2025-31161CrushFTP CrushFTP primary impact Mapped2025-04-07
CVE-2025-22457Ivanti Connect Secure, Policy Secure, and ZTA Gateways primary impact Mapped2025-04-04
CVE-2025-21590Juniper Junos OS primary impact Mapped2025-03-13
CVE-2025-24201Apple Multiple Products primary impact Mapped2025-03-13
CVE-2025-24985Microsoft Windows primary impact Mapped2025-03-11
CVE-2024-57968Advantive VeraCore primary impact Mapped2025-03-10
CVE-2024-4885Progress WhatsUp Gold primary impact Mapped2025-03-03
CVE-2022-43769Hitachi Vantara Pentaho Business Analytics (BA) Server primary impact Mapped2025-03-03
CVE-2022-43939Hitachi Vantara Pentaho Business Analytics (BA) Server primary impact Mapped2025-03-03
CVE-2023-20118Cisco Small Business RV Series Routers primary impact Mapped2025-03-03
CVE-2023-34192Synacor Zimbra Collaboration Suite (ZCS) primary impact Mapped2025-02-25
CVE-2024-20953Oracle Agile Product Lifecycle Management (PLM) primary impact Mapped2025-02-24
CVE-2024-57727SimpleHelp SimpleHelp secondary impact Mapped2025-02-13
CVE-2024-41710Mitel SIP Phones primary impact Mapped2025-02-12
CVE-2025-0994Trimble Cityworks primary impact Mapped2025-02-07
CVE-2020-29574Sophos CyberoamOS primary impact Mapped2025-02-06
CVE-2024-21413Microsoft Office Outlook primary impact Mapped2025-02-06
CVE-2022-23748Audinate Dante Discovery exploitation technique Mapped2025-02-06
CVE-2024-53104Linux Kernel primary impact Mapped2025-02-05
CVE-2024-29059Microsoft .NET Framework primary impact Mapped2025-02-04
CVE-2024-45195Apache OFBiz primary impact Mapped2025-02-04
CVE-2025-24085Apple Multiple Products primary impact Mapped2025-01-29
CVE-2025-23006SonicWall SMA1000 Appliances primary impact Mapped2025-01-24
CVE-2024-50603Aviatrix Controllers primary impact Mapped2025-01-16
CVE-2023-48365Qlik Sense primary impact Mapped2025-01-13
CVE-2024-12686BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) exploitation technique Mapped2025-01-13
CVE-2024-5217ServiceNow Utah, Vancouver, and Washington DC Now Platform exploitation technique Mapped2024-07-29
CVE-2024-4879ServiceNow Utah, Vancouver, and Washington DC Now Platform exploitation technique Mapped2024-07-29
CVE-2024-34102Adobe Commerce and Magento Open Source primary impact Mapped2024-07-17
CVE-2024-20399Cisco NX-OS primary impact Mapped2024-07-02
CVE-2024-26169Microsoft Windows primary impact Mapped2024-06-13
CVE-2024-4577PHP Group PHP primary impact Mapped2024-06-12
CVE-2024-4947Google Chromium V8 primary impact Mapped2024-05-20
CVE-2024-4761Google Chromium V8 exploitation technique Mapped2024-05-16
CVE-2024-4671Google Chromium primary impact Mapped2024-05-13
CVE-2024-20359Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) primary impact Mapped2024-04-24
CVE-2023-48788Fortinet FortiClient EMS primary impact Mapped2024-03-25
CVE-2024-27198JetBrains TeamCity primary impact Mapped2024-03-07
CVE-2023-43770Roundcube Webmail primary impact Mapped2024-02-12
CVE-2024-21887Ivanti Connect Secure and Policy Secure primary impact Mapped2024-01-10
CVE-2023-7101Spreadsheet::ParseExcel Spreadsheet::ParseExcel primary impact Mapped2024-01-02
CVE-2023-36845Juniper Junos OS primary impact Mapped2023-11-13
CVE-2023-36846Juniper Junos OS primary impact Mapped2023-11-13
CVE-2023-36847Juniper Junos OS primary impact Mapped2023-11-13
CVE-2023-36851Juniper Junos OS primary impact Mapped2023-11-13
CVE-2023-20273Cisco Cisco IOS XE Web UI secondary impact Mapped2023-10-23
CVE-2023-20109Cisco IOS and IOS XE primary impact Mapped2023-10-10
CVE-2023-22515Atlassian Confluence Data Center and Server secondary impact Mapped2023-10-05
CVE-2023-40044Progress WS_FTP Server exploitation technique Mapped2023-10-05
CVE-2023-41179Trend Micro Apex One and Worry-Free Business Security primary impact Mapped2023-09-21
CVE-2021-3129Laravel Ignition primary impact Mapped2023-09-18
CVE-2023-33246Apache RocketMQ primary impact Mapped2023-09-06
CVE-2023-38035Ivanti Sentry primary impact Mapped2023-08-22
CVE-2023-26359Adobe ColdFusion primary impact Mapped2023-08-21
CVE-2023-35081Ivanti Endpoint Manager Mobile (EPMM) primary impact Mapped2023-07-31
CVE-2022-29303SolarView Compact primary impact Mapped2023-07-13
CVE-2023-20867VMware Tools primary impact Mapped2023-06-23
CVE-2023-20887VMware Aria Operations for Networks primary impact Mapped2023-06-22
CVE-2023-34362Progress MOVEit Transfer primary impact Mapped2023-06-02
CVE-2023-2868Barracuda Networks Email Security Gateway (ESG) Appliance primary impact Mapped2023-05-26
CVE-2021-45046Apache Log4j2 primary impact Mapped2023-05-01
CVE-2023-27350PaperCut MF/NG primary impact Mapped2023-04-21
CVE-2017-6742Cisco IOS and IOS XE Software primary impact Mapped2023-04-19
CVE-2023-28252Microsoft Windows secondary impact Mapped2023-04-11
CVE-2022-42948Fortra Cobalt Strike primary impact Mapped2023-03-30
CVE-2022-39197Fortra Cobalt Strike primary impact Mapped2023-03-30
CVE-2022-35914Teclib GLPI exploitation technique Mapped2023-03-07
CVE-2023-22952SugarCRM Multiple Products primary impact Stale2023-02-02
CVE-2022-26500Veeam Backup & Replication primary impact Mapped2022-12-13
CVE-2022-26501Veeam Backup & Replication primary impact Mapped2022-12-13
CVE-2022-41125Microsoft Windows secondary impact Mapped2022-11-08
CVE-2022-36804Atlassian Bitbucket Server and Data Center primary impact Mapped2022-09-30
CVE-2022-35405Zoho ManageEngine exploitation technique Mapped2022-09-22
CVE-2022-37969Microsoft Windows secondary impact Mapped2022-09-14
CVE-2022-26258D-Link DIR-820L primary impact Mapped2022-09-08
CVE-2022-21971Microsoft Windows primary impact Mapped2022-08-18
CVE-2022-34713Microsoft Windows secondary impact Mapped2022-08-09
CVE-2022-22047Microsoft Windows secondary impact Mapped2022-07-12
CVE-2010-2883Adobe Acrobat and Reader secondary impact Mapped2022-06-08
CVE-2022-22947VMware Spring Cloud Gateway primary impact Mapped2022-05-16
CVE-2022-24521Microsoft Windows secondary impact Mapped2022-04-13
CVE-2021-31166Microsoft HTTP Protocol Stack primary impact Mapped2022-04-06
CVE-2022-22965VMware Spring Framework primary impact Mapped2022-04-04
CVE-2021-45382D-Link Multiple Routers primary impact Mapped2022-04-04
CVE-2022-1040Sophos Firewall primary impact Mapped2022-03-31
CVE-2022-21999Microsoft Windows secondary impact Mapped2022-03-25
CVE-2021-42237Sitecore XP primary impact Mapped2022-03-25
CVE-2022-23131Zabbix Frontend secondary impact Mapped2022-02-22
CVE-2020-0787Microsoft Windows primary impact Mapped2022-01-28
CVE-2021-35394Realtek Jungle Software Development Kit (SDK) primary impact Mapped2021-12-10
CVE-2021-22204Perl Exiftool primary impact Mapped2021-11-17
CVE-2021-42321Microsoft Exchange primary impact Mapped2021-11-17
CVE-2021-27104Accellion FTA primary impact Mapped2021-11-03
CVE-2021-27102Accellion FTA primary impact Mapped2021-11-03
CVE-2021-27101Accellion FTA primary impact Mapped2021-11-03
CVE-2017-9805Apache Struts primary impact Mapped2021-11-03
CVE-2021-42013Apache HTTP Server primary impact Mapped2021-11-03
CVE-2021-41773Apache HTTP Server primary impact Mapped2021-11-03
CVE-2016-4437Apache Shiro primary impact Mapped2021-11-03
CVE-2019-17558Apache Solr primary impact Mapped2021-11-03
CVE-2020-17530Apache Struts primary impact Mapped2021-11-03
CVE-2017-5638Apache Struts primary impact Mapped2021-11-03
CVE-2018-11776Apache Struts primary impact Mapped2021-11-03
CVE-2019-3398Atlassian Confluence Server and Data Center primary impact Mapped2021-11-03
CVE-2021-26084Atlassian Confluence Server and Data Center primary impact Mapped2021-11-03
CVE-2019-11580Atlassian Crowd and Crowd Data Center primary impact Mapped2021-11-03
CVE-2021-42258BQE BillQuick Web Suite primary impact Mapped2021-11-03
CVE-2020-3580Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) primary impact Mapped2021-11-03
CVE-2021-1497Cisco HyperFlex HX primary impact Mapped2021-11-03
CVE-2021-1498Cisco HyperFlex HX primary impact Mapped2021-11-03
CVE-2019-13608Citrix StoreFront Server primary impact Mapped2021-11-03
CVE-2019-19781Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance primary impact Mapped2021-11-03
CVE-2019-11634Citrix Workspace Application and Receiver for Windows primary impact Mapped2021-11-03
CVE-2020-29557D-Link DIR-825 R1 Devices primary impact Mapped2021-11-03
CVE-2020-25506D-Link DNS-320 Device primary impact Mapped2021-11-03
CVE-2017-9822DotNetNuke (DNN) DotNetNuke (DNN) primary impact Mapped2021-11-03
CVE-2020-8515DrayTek Multiple Vigor Routers primary impact Mapped2021-11-03
CVE-2018-7600Drupal Drupal Core primary impact Mapped2021-11-03
CVE-2021-22205GitLab Community and Enterprise Editions primary impact Mapped2021-11-03
CVE-2018-6789Exim Exim primary impact Mapped2021-11-03
CVE-2020-5902F5 BIG-IP primary impact Stale2021-11-03
CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management primary impact Mapped2021-11-03
CVE-2021-35464ForgeRock Access Management (AM) primary impact Mapped2021-11-03
CVE-2020-15505Ivanti MobileIron Multiple Products primary impact Mapped2021-11-03
CVE-2017-11882Microsoft Office primary impact Mapped2021-11-03
CVE-2021-22893Ivanti Pulse Connect Secure primary impact Mapped2021-11-03
CVE-2021-22900Ivanti Pulse Connect Secure exploitation technique Mapped2021-11-03
CVE-2021-22894Ivanti Pulse Connect Secure primary impact Mapped2021-11-03
CVE-2019-11510Ivanti Pulse Connect Secure primary impact Mapped2021-11-03
CVE-2021-22005VMware vCenter Server primary impact Mapped2021-11-03
CVE-2021-21972VMware vCenter Server primary impact Mapped2021-11-03

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1059

Suspicious Browser Child Process - MacOS mediumtest
Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Techniques: T1189T1203T1059
Add New Download Source To Winget mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Techniques: T1059
Potential Arbitrary Command Execution Via FTP.EXE mediumtest
Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Techniques: T1059T1202
Use of Pcalua For Execution mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Techniques: T1059
Shai-Hulud Malware Indicators - Linux highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Techniques: T1059
Script Interpreter Execution From Suspicious Folder hightest
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Techniques: T1059
DNS Request From Windows Script Host lowtest
Author: Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Techniques: T1059
Windows Shell/Scripting Application File Write to Suspicious Folder hightest
Author: Florian Roth (Nextron Systems) · 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Techniques: T1059
Elevated System Shell Spawned From Uncommon Parent Location mediumtest
Author: frack113, Tim Shelton (update fp) · 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Techniques: T1059
DarkGate - Autoit3.EXE File Creation By Uncommon Process mediumtest
Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Techniques: T1105T1059
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) mediumtest
Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Techniques: T1059T1190
CVE tags: CVE-2023-22518
Ruby Inline Command Execution mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Techniques: T1059
Payload Decoded and Decrypted via Built-in Utilities mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Techniques: T1059T1204T1140
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Techniques: T1059
Renamed PingCastle Binary Execution hightest
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Techniques: T1059T1202
Potential KamiKakaBot Activity - Lure Document Execution mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-03-22 · logsource: product=windows category=process_creation · 24474469-bd80-46cc-9e08-9fbe81bfaaca
Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.
Techniques: T1059
Hacktool Ruler hightest
Author: Florian Roth (Nextron Systems) · 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae
This events that are generated when using the hacktool Ruler by Sensepost
Techniques: T1087T1114T1059T1550.002
Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt hightest
Author: Bhabesh Raj · 2021-09-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 245f92e3-c4da-45f1-9070-bc552e06db11
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084
Techniques: T1190T1059
CVE tags: CVE-2021-26084
Lazarus Group Activity criticaltest
Author: Florian Roth (Nextron Systems), wagga · 2020-12-23 (modified 2023-03-10) · logsource: product=windows category=process_creation · 24c4d154-05a4-4b99-b57d-9b977472443a
Detects different process execution behaviors as described in various threat reports on Lazarus group activity
Techniques: T1059
Renamed NirCmd.EXE Execution hightest
Author: X__Junior (Nextron Systems) · 2024-03-11 · logsource: product=windows category=process_creation · 264982dc-dbad-4dce-b707-1e0d3e0f73d9
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Techniques: T1059T1202
Windows Suspicious Child Process from Node.js - React2Shell highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali · 2025-12-05 · logsource: product=windows category=process_creation · 271de298-cc0e-4842-acd8-079a0a99ea65
Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell). Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync(). If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked. For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.
Techniques: T1059T1190
CVE tags: CVE-2025-55182
Renamed FTP.EXE Execution mediumtest
Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2023-02-03) · logsource: product=windows category=process_creation · 277a4393-446c-449a-b0ed-7fdc7795244c
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Techniques: T1059T1202
Suspicious Invocation of Shell via Rsync highexperimental
Author: Florian Roth · 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Techniques: T1059T1203
Wscript Shell Run In CommandLine mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-08-31 (modified 2023-05-15) · logsource: product=windows category=process_creation · 2c28c248-7f50-417a-9186-a85b223010ee
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
Techniques: T1059
Inline Python Execution - Spawn Shell Via OS System Library hightest
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · 2d2f44ff-4611-4778-a8fc-323a0e9850cc
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
Techniques: T1059
Install New Package Via Winget Local Manifest mediumtest
Author: Sreeman, Florian Roth (Nextron Systems), frack113 · 2020-04-21 (modified 2023-04-17) · logsource: product=windows category=process_creation · 313d6012-51a0-4d93-8dfc-de8553239e25
Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.
Techniques: T1059
Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE mediumtest
Author: @kostastsale · 2023-06-01 · logsource: product=windows category=process_creation · 39ac1fb0-07f1-474b-b97e-c5c0eace0d79
Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files. MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\Windows\\Microsoft\.NET\\Framework64\\v4\.0\.30319\\Temporary ASP\.NET Files\\root\\([a-z0-9]{5,12})\\([a-z0-9]{5,12})\\App_Web_[a-z0-9]{5,12}\.dll. Hunting Opportunity Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.
Techniques: T1059
CVE tags: CVE-2023-34362
HackTool - Sliver C2 Implant Activity Pattern criticaltest
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) · 2022-08-25 (modified 2023-03-05) · logsource: product=windows category=process_creation · 42333b2c-b425-441c-b70e-99404a17170f
Detects process activity patterns as seen being used by Sliver C2 framework implants
Techniques: T1059
Shell Execution via Git - Linux hightest
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · 47b3bbd4-1bf7-48cc-84ab-995362aaa75a
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Techniques: T1059
Python Spawning Pretty TTY on Windows hightest
Author: Nextron Systems · 2022-06-03 · logsource: product=windows category=process_creation · 480e7e51-e797-47e3-8d72-ebfce65b6d8d
Detects python spawning a pretty tty
Techniques: T1059
Unusual Parent Process For Cmd.EXE mediumtest
Author: Tim Rauch, Elastic (idea) · 2022-09-21 (modified 2023-12-05) · logsource: product=windows category=process_creation · 4b991083-3d0e-44ce-8fc4-b254025d8d4b
Detects suspicious parent process for cmd.exe
Techniques: T1059
Potential Xterm Reverse Shell mediumtest
Author: @d4ns4n_ · 2023-04-24 · logsource: product=linux category=process_creation · 4e25af4b-246d-44ea-8563-e42aacab006b
Detects usage of "xterm" as a potential reverse shell tunnel
Techniques: T1059
Shai-Hulud Malware Indicators - Windows highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 540703fb-a874-4385-a9d6-7cd1bfab268c
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Techniques: T1059
Outlook EnableUnsafeClientMailRules Setting Enabled hightest
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems) · 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · 55f0a3a1-846e-40eb-8273-677371b8d912
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
Techniques: T1059T1202
VMToolsd Suspicious Child Process hightest
Author: bohops, Bhabesh Raj · 2021-10-08 (modified 2023-07-25) · logsource: product=windows category=process_creation · 5687f942-867b-4578-ade7-1e341c46e99a
Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
Techniques: T1059
Windows Defender Threat Detected highstable
Author: Ján Trenčanský · 2020-07-28 · logsource: product=windows service=windefend · 57b649ef-ff42-4fb0-8bf6-62da243a1708
Detects actions taken by Windows Defender malware detection engines
Techniques: T1059
REvil Kaseya Incident Malware Patterns criticaltest
Author: Florian Roth (Nextron Systems) · 2021-07-03 (modified 2022-05-20) · logsource: product=windows category=process_creation · 5de632bc-7fbd-4c8a-944a-fce55c59eae5
Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)
Techniques: T1059
Elevated System Shell Spawned mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2023-11-23 (modified 2025-03-06) · logsource: product=windows category=process_creation · 61065c72-5d7d-44ef-bf41-6a36684b545f
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
Techniques: T1059
Potentially Suspicious Execution From Parent Process In Public Folder hightest
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-25 (modified 2024-07-12) · logsource: product=windows category=process_creation · 69bd9b97-2be2-41b6-9816-fb08757a4d1a
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Techniques: T1564T1059
Suspicious RASdial Activity mediumtest
Author: juju4 · 2019-01-16 (modified 2021-11-27) · logsource: product=windows category=process_creation · 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e
Detects suspicious process related to rasdial.exe
Techniques: T1059
Suspicious Execution via macOS Script Editor mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Techniques: T1566T1566.002T1059T1059.002T1204T1204.001T1553
PCRE.NET Package Temp Files hightest
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=file_event · 6e90ae7a-7cd3-473f-a035-4ebb72d961da
Detects processes creating temp files related to PCRE.NET package
Techniques: T1059
Azure New CloudShell Created mediumtest
Author: Austin Songer · 2021-09-21 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 72af37e2-ec32-47dc-992b-bc288a2708cb
Identifies when a new cloudshell is created inside of Azure portal.
Techniques: T1059
Renamed CURL.EXE Execution mediumtest
Author: X__Junior (Nextron Systems) · 2023-09-11 (modified 2023-10-12) · logsource: product=windows category=process_creation · 7530cd3d-7671-43e3-b209-976966f6ea48
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
Techniques: T1059T1202
Abusable DLL Potential Sideloading From Suspicious Location hightest
Author: X__Junior (Nextron Systems) · 2023-07-11 · logsource: product=windows category=image_load · 799a5f48-0ac1-4e0f-9152-71d137d48c2a
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Techniques: T1059
HackTool - Stracciatella Execution hightest
Author: pH-T (Nextron Systems) · 2023-04-17 (modified 2024-11-23) · logsource: product=windows category=process_creation · 7a4d9232-92fc-404d-8ce1-4c92e7caf539
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Techniques: T1059T1685
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 7aa4e81a-a65c-4e10-9f81-b200eb229d7d
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
Techniques: T1059
Ursnif Redirection Of Discovery Commands hightest
Author: @kostastsale · 2023-07-16 · logsource: product=windows category=process_creation · 7aaa5739-12fc-41aa-b98b-23ec27d42bdf
Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.
Techniques: T1059
Vim GTFOBin Abuse - Linux hightest
Author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux · 2022-12-28 (modified 2026-06-05) · logsource: product=linux category=process_creation · 7ab8f73a-fcff-428b-84aa-6a5ff7877dea
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Techniques: T1059T1083
Potential Netcat Reverse Shell Execution hightest
Author: @d4ns4n_, Nasreddine Bencherchali (Nextron Systems) · 2023-04-07 · logsource: product=linux category=process_creation · 7f734ed0-4f47-46c0-837f-6ee62505abd9
Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.
Techniques: T1059
Atlassian Confluence CVE-2022-26134 hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-03 · logsource: product=linux category=process_creation · 7fb14105-530e-4e2e-8cfb-99f7d8700b66
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134
Techniques: T1190T1059
CVE tags: CVE-2022-26134
BPFDoor Abnormal Process ID or Lock File Accessed hightest
Author: Rafal Piasecki · 2022-08-10 (modified 2026-03-30) · logsource: product=linux service=auditd · 808146b2-9332-4d78-9416-d7e47012d83d
detects BPFDoor .lock and .pid files access in temporary file storage facility
Techniques: T1106T1059
Use of OpenConsole mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-16 · logsource: product=windows category=process_creation · 814c95cc-8192-4378-a70a-f1aafd877af1
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Techniques: T1059
Add Insecure Download Source To Winget hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Techniques: T1059
PCRE.NET Package Image Load hightest
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=image_load · 84b0a8f3-680b-4096-a45b-e9a89221727c
Detects processes loading modules related to PCRE.NET package
Techniques: T1059
PowerShell Download and Execution Cradles hightest
Author: Florian Roth (Nextron Systems) · 2022-03-24 (modified 2025-07-18) · logsource: product=windows category=process_creation · 85b0b087-eddf-4a2b-b033-d771fa2b9775
Detects PowerShell download and execution cradles.
Techniques: T1059
Shell Invocation Via Ssh - Linux hightest
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-08-29 · logsource: product=linux category=process_creation · 8737b7f6-8df3-4bb7-b1da-06019b99b687
Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Techniques: T1059
Potential CVE-2021-40444 Exploitation Attempt hightest
Author: Florian Roth (Nextron Systems), @neonprimetime · 2021-09-08 (modified 2023-02-04) · logsource: product=windows category=process_creation · 894397c6-da03-425c-a589-3d09e7d1f750
Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations
Techniques: T1059
CVE tags: CVE-2021-40444
Python Inline Command Execution mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 (modified 2025-10-07) · logsource: product=windows category=process_creation · 899133d5-4d7c-4a7f-94ee-27355c879d90
Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.
Techniques: T1059
Suspicious Invocation of Shell via AWK - Linux hightest
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · 8c1a5675-cb85-452f-a298-b01b22a51856
Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Techniques: T1059
Suspicious ArcSOC.exe Child Process highexperimental
Author: Micah Babinski · 2025-11-25 · logsource: product=windows category=process_creation · 8e95e73e-ba02-4a87-b4d7-0929b8053038
Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process.
Techniques: T1059T1203
Manual Execution of Script Inside of a Compressed File mediumtest
Author: @kostastsale · 2023-02-15 (modified 2024-08-13) · logsource: product=windows category=process_creation · 95724fc1-a258-4674-97db-a30351981c5a
This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries. From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios. 1. Compressed file opened using 7zip. 2. Compressed file opened using WinRar. 3. Compressed file opened using native windows File Explorer capabilities. When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."
Techniques: T1059
Forfiles Command Execution mediumtest
Author: Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2024-03-05) · logsource: product=windows category=process_creation · 9aa5106d-bce3-4b13-86df-3a20f1d5cf0b
Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.
Techniques: T1059
Potential Dosfuscation Activity mediumtest
Author: frack113, Nasreddine Bencherchali (Nextron Systems) · 2022-02-15 (modified 2023-03-06) · logsource: product=windows category=process_creation · a77c1610-fc73-4019-8e29-0f51efc04a51
Detects possible payload obfuscation via the commandline
Techniques: T1059
Writing Of Malicious Files To The Fonts Folder mediumtest
Author: Sreeman · 2020-04-21 (modified 2022-03-08) · logsource: product=windows category=process_creation · ae9b0bd7-8888-4606-b444-0ed7410cb728
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.
Techniques: T1211T1059
Suspicious Greedy Compression Using Rar.EXE hightest
Author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems) · 2022-12-15 (modified 2024-01-02) · logsource: product=windows category=process_creation · afe52666-401e-4a02-b4ff-5d128990b8cb
Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes
Techniques: T1059
Use of FSharp Interpreters mediumtest
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io · 2022-06-02 (modified 2024-04-23) · logsource: product=windows category=process_creation · b96b2031-7c17-4473-afe7-a30ce714db29
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline.
Techniques: T1059
Suspicious File Created In PerfLogs mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-05-05 · logsource: product=windows category=file_event · bbb7e38c-0b41-4a11-b306-d2a457b7ac2b
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Techniques: T1059
PUA - Wsudo Suspicious Execution hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-12-02 (modified 2023-02-14) · logsource: product=windows category=process_creation · bdeeabc9-ff2a-4a51-be59-bb253aac7891
Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)
Techniques: T1059
Potentially Suspicious NTFS Symlink Behavior Modification mediumtest
Author: frack113, The DFIR Report · 2022-03-02 (modified 2025-11-13) · logsource: product=windows category=process_creation · c0b2768a-dd06-4671-8339-b16ca8d1f27f
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Techniques: T1059T1222.001
Windows Defender Exclusions Added - PowerShell mediumtest
Author: Tim Rauch, Elastic (idea) · 2022-09-16 (modified 2022-11-26) · logsource: product=windows category=ps_script · c1344fa2-323b-4d2e-9176-84b4d4821c88
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Techniques: T1685T1059
Add Potential Suspicious New Download Source To Winget mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 (modified 2023-12-04) · logsource: product=windows category=process_creation · c15a46a0-07d4-4c87-b4b6-89207835a83b
Detects usage of winget to add new potentially suspicious download sources
Techniques: T1059
Python Spawning Pretty TTY Via PTY Module mediumtest
Author: Nextron Systems · 2022-06-03 (modified 2024-11-04) · logsource: product=linux category=process_creation · c4042d54-110d-45dd-a0e1-05c47822c937
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
Techniques: T1059
Turla Group Lateral Movement criticaltest
Author: Markus Neis · 2017-11-07 (modified 2022-10-09) · logsource: product=windows category=process_creation · c601f20d-570a-4cde-a7d6-e17f99cb8e7f
Detects automated lateral movement by Turla group
Techniques: T1059T1021.002T1083T1135
Linux Suspicious Child Process from Node.js - React2Shell highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali · 2025-12-05 · logsource: product=linux category=process_creation · c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7
Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands. When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>). For other methods, the Image field will show the spawned process directly.
Techniques: T1059T1190
CVE tags: CVE-2025-55182
Run PowerShell Script from Redirected Input Stream hightest
Author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community · 2020-10-17 (modified 2021-11-27) · logsource: product=windows category=process_creation · c83bf4b5-cdf0-437c-90fa-43d734f7c476
Detects PowerShell script execution via input stream redirect
Techniques: T1059
Conhost Spawned By Uncommon Parent Process mediumtest
Author: Tim Rauch, Elastic (idea) · 2022-09-28 (modified 2025-03-06) · logsource: product=windows category=process_creation · cbb9e3d1-2386-4e59-912e-62f1484f7a89
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Techniques: T1059
Suspicious Java Children Processes hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2022-06-03 · logsource: product=linux category=process_creation · d292e0af-9a18-420c-9525-ec0ac3936892
Detects java process spawning suspicious children
Techniques: T1059
Sysprep on AppData Folder mediumtest
Author: Florian Roth (Nextron Systems) · 2018-06-22 (modified 2021-11-27) · logsource: product=windows category=process_creation · d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
Techniques: T1059
Php Inline Command Execution mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · d81871ef-5738-47ab-9797-7a9c90cd4bfb
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Techniques: T1059
Capsh Shell Invocation - Linux hightest
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 · logsource: product=linux category=process_creation · db1ac3be-f606-4e3a-89e0-9607cbe6b98a
Detects the use of the "capsh" utility to invoke a shell.
Techniques: T1059
DarkGate - Drop DarkGate Loader In C:\Temp Directory mediumtest
Author: Tomasz Dyduch, Josh Nickels · 2024-05-31 · logsource: product=windows category=file_event · df49c691-8026-48dd-94d3-4ba6a79102a8
Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
Techniques: T1059
Suspicious Installer Package Child Process mediumtest
Author: Sohan G (D4rkCiph3r) · 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Techniques: T1059T1059.007T1071T1071.001
Suspicious Remote Child Process From Outlook hightest
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems) · 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · e212d415-0e93-435f-9e1a-f29005bb4723
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
Techniques: T1059T1202
Shell Execution via Rsync - Linux highexperimental
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth · 2024-09-02 (modified 2025-01-18) · logsource: product=linux category=process_creation · e2326866-609f-4015-aea9-7ec634e8aa04
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Techniques: T1059
Windows Defender AMSI Trigger Detected highstable
Author: Bhabesh Raj · 2020-09-14 (modified 2022-12-07) · logsource: product=windows service=windefend · ea9bf0fa-edec-4fb8-8b78-b119f2528186
Detects triggering of AMSI by Windows Defender.
Techniques: T1059
Suspicious Runscripthelper.exe mediumtest
Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2022-07-11) · logsource: product=windows category=process_creation · eca49c87-8a75-4f13-9c73-a5a29e845f03
Detects execution of powershell scripts via Runscripthelper.exe
Techniques: T1059T1202
Installation of WSL Kali-Linux highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-10 · logsource: product=windows category=process_creation · eca8ae39-5c3c-4321-b538-9e64fe25822e
Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Techniques: T1059
Suspicious Program Names hightest
Author: Florian Roth (Nextron Systems) · 2022-02-11 (modified 2023-03-22) · logsource: product=windows category=process_creation · efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Techniques: T1059
Potential CobaltStrike Process Patterns hightest
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2021-07-27 (modified 2023-03-29) · logsource: product=windows category=process_creation · f35c5d71-b489-4e22-a115-f003df287317
Detects potential process patterns related to Cobalt Strike beacon activity
Techniques: T1059
Perl Inline Command Execution mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · f426547a-e0f7-441a-b63e-854ac5bdf54d
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Techniques: T1059
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux) hightest
Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=linux category=process_creation · f8987c03-4290-4c96-870f-55e75ee377f4
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Techniques: T1059T1190
CVE tags: CVE-2023-22518
Suspicious Scan Loop Network mediumtest
Author: frack113 · 2022-03-12 · logsource: product=windows category=process_creation · f8ad2e2c-40b6-4117-84d7-20b89896ab23
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system
Techniques: T1059T1018
DarkGate - Autoit3.EXE Execution Parameters hightest
Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=process_creation · f8e9aa1c-14f2-4dbd-aa59-b98968ed650d
Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.
Techniques: T1059
Clfs.SYS Loaded By Process Located In a Potential Suspicious Location mediumexperimental
Author: X__Junior · 2025-01-20 · logsource: product=windows category=image_load · fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
Techniques: T1059

Sub-techniques

IDNameSigma rulesKEV CVEs
T1059.001PowerShell2201
T1059.002AppleScript90
T1059.003Windows Command Shell466
T1059.004Unix Shell1814
T1059.005Visual Basic290
T1059.006Python130
T1059.007JavaScript2914
T1059.008Network Device CLI00
T1059.009Cloud API30
T1059.010AutoHotKey & AutoIT00
T1059.011Lua00
T1059.012Hypervisor CLI90
T1059.013Container CLI/API00