Windows indirection utility spawning a scripting or download tool

1title: Windows indirection utility spawning a scripting or download tool2id: 6a33dcce-199f-4195-a4ea-03c30555b8673status: experimental4description: |5  Steps 1 and 2 of AN0576's chain in a single event: a process creation whose6  parent is one of the Windows utilities that exist to launch something else —7  forfiles.exe, pcalua.exe, ScriptRunner.exe — and whose own image is one of8  the interpreters, proxy binaries and downloaders that indirection is used to9  reach. That child list is MITRE's `HighRiskChildren` knob, populated here10  with its named entries plus wscript, cscript and certutil. A second,11  independent selection covers the ssh.exe variant the technique text12  describes: `ProxyCommand` and `LocalCommand` make ssh.exe execute a local13  command, and both appear literally on the command line when passed with -o.14  wsl.exe is named by both MITRE and the analytic and is deliberately absent.15  A command run through WSL executes inside the Linux VM and never surfaces as16  a Windows process creation, so the parent/child pair cannot fire for it; the17  only remaining option would be matching wsl.exe's own command line, which on18  a developer workstation is ordinary daily use. The ssh.exe selection has the19  mirror-image weakness: an operator who writes ProxyCommand or LocalCommand20  into %USERPROFILE%\.ssh\config instead of passing -o leaves nothing on the21  command line, and catching that needs the file-access leg of the analytic on22  a separate logsource.23  The rest of AN0576 is out of reach here. Step 3 — the SSH config write — and24  the network connections from the utility or its child are different events on25  different logsources, and the analytic's `TimeWindow` knob for correlating26  them is a join Sigma cannot express; `DestCIDRs` and `UserContext` are27  likewise post-hoc filters rather than literals. Prerequisite: the brief maps28  this to Sysmon EventID 1, so the fields are Sysmon's, and the rule sees29  nothing unless Sysmon is installed with a configuration that does not exclude30  these images from process creation. A Security 4688 feed needs the field31  names remapped (NewProcessName / ParentProcessName), plus Audit Process32  Creation and the separate command-line policy for the ssh.exe selection to33  have anything to read.34  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0200, not hand-written and not tested by its author. Any lab result is on this rule's own page.35references:36  - https://attack.mitre.org/techniques/T120237  - https://attack.mitre.org/detectionstrategies/DET020038author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)39date: 2026-08-1640tags:41  - attack.defense-evasion42  - attack.t120243logsource:44  category: process_creation45  product: windows46detection:47  selection_indirection_parent:48    ParentImage|endswith:49      - '\forfiles.exe'50      - '\pcalua.exe'51      - '\scriptrunner.exe'52  selection_high_risk_child:53    Image|endswith:54      - '\powershell.exe'55      - '\pwsh.exe'56      - '\cmd.exe'57      - '\wscript.exe'58      - '\cscript.exe'59      - '\mshta.exe'60      - '\rundll32.exe'61      - '\regsvr32.exe'62      - '\msiexec.exe'63      - '\curl.exe'64      - '\bitsadmin.exe'65      - '\certutil.exe'66  selection_ssh_command_option:67    Image|endswith: '\ssh.exe'68    CommandLine|contains:69      - 'ProxyCommand'70      - 'LocalCommand'71  condition: (selection_indirection_parent and selection_high_risk_child) or selection_ssh_command_option72falsepositives:73  - "Scheduled log and cache pruning built on forfiles.exe. Its /c argument is always executed through cmd.exe, so every run of the classic forfiles delete one-liner produces the parent/child pair this rule matches, on a fixed schedule, on every server that runs one."74  - "App-V and MSIX packages published through ScriptRunner.exe, which launches the package's own cmd.exe or powershell.exe scripts at publish, launch and removal time on every machine the package is deployed to."75  - "The Program Compatibility Assistant relaunching a legacy installer or shortcut through pcalua.exe, which then calls msiexec.exe to complete an entirely ordinary installation."76  - "Administrators and developers reaching an internal host through a jump box with an SSH ProxyCommand entry, which puts the option on ssh.exe's command line on every single hop."77level: medium