atomic-red-team/atomics/T1202/T1202.md

T1202 - Indirect Command Execution

Description from ATT&CK

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)

Adversaries may abuse these features for Defense Evasion, specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of cmd or file extensions more commonly associated with malicious payloads.

Atomic Tests

• Atomic Test #1 - Indirect Command Execution - pcalua.exe

• Atomic Test #2 - Indirect Command Execution - forfiles.exe

• Atomic Test #3 - Indirect Command Execution - conhost.exe

Atomic Test #1 - Indirect Command Execution - pcalua.exe

The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface. Reference Upon execution, calc.exe should open

Supported Platforms: Windows

auto_generated_guid: cecfea7a-5f03-4cdd-8bc8-6f7c22862440

Inputs:

Name	Description	Type	Default Value
payload_path	Path to payload	Path	C:\Windows\System32\calc.exe
process	Process to execute	String	calc.exe

Attack Commands: Run with command_prompt!

pcalua.exe -a #{process}
pcalua.exe -a #{payload_path}

Atomic Test #2 - Indirect Command Execution - forfiles.exe

forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface. Reference "This is basically saying for each occurrence of notepad.exe in c:\windows\system32 run calc.exe" Upon execution calc.exe will be opened.

Supported Platforms: Windows

auto_generated_guid: 8b34a448-40d9-4fc3-a8c8-4bb286faf7dc

Inputs:

Name	Description	Type	Default Value
process	Process to execute	String	calc.exe

Attack Commands: Run with command_prompt!

forfiles /p c:\windows\system32 /m notepad.exe /c #{process}

Atomic Test #3 - Indirect Command Execution - conhost.exe

conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer. Executing it through command line can create process ancestry anomalies [Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)

Supported Platforms: Windows

auto_generated_guid: cf3391e0-b482-4b02-87fc-ca8362269b29

Inputs:

Name	Description	Type	Default Value
process	Process to execute	String	notepad.exe

Attack Commands: Run with command_prompt!

conhost.exe "#{process}"