Indirect Command Execution (MITRE ATT&CK T1202) is the abuse of Windows utilities that can run commands, to get around restrictions on command-line interpreters. MITRE files it under Stealth and lists Windows.
How attackers use it
MITRE names several utilities that can start programs and commands without invoking cmd directly: Forfiles, the Program Compatibility Assistant (pcalua.exe), parts of the Windows Subsystem for Linux, and Scriptrunner.exe. Adversaries may also abuse ssh.exe, using the ProxyCommand and LocalCommand options, either through the -o flag or by editing the SSH config file.
The goal is stealth. The attacker wants arbitrary execution while avoiding detections and controls, such as Group Policy, that limit cmd or the file extensions more often tied to malicious payloads.
How to detect it
MITRE's detection strategy is a cause and effect chain:
- A user or service launches an indirection utility, such as forfiles.exe, pcalua.exe, wsl.exe, scriptrunner.exe or ssh.exe with -o ProxyCommand or LocalCommand.
- That utility starts a second program or command (PowerShell, cmd, msiexec, regsvr32, curl or any executable), or opens outbound network connections.
- Optionally, someone first changed the SSH config to persist a LocalCommand or ProxyCommand.
Correlate process creation, command-line content, file access to the SSH config under the user profile, and network connections from the utility or its child. Process creation with parent and command line (Sysmon event ID 1 or Security event 4688) is the key source.
Useful alerts: forfiles or pcalua as the parent of PowerShell or a script host, and ssh.exe with a ProxyCommand or LocalCommand argument.
How to reduce the risk
MITRE says this technique cannot be easily mitigated with preventive controls, since it is based on abuse of system features. That makes detection the main defense. Tune your process creation rules for the utilities above, and review SSH configuration files on Windows hosts that have no reason to use them.
Quick check
Why does MITRE say prevention is hard here?
The technique abuses legitimate system features, so blocking them outright is usually impractical. Detection of unusual parent and child process pairs is the main control.
