{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1202","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"8c2c1dcbc28d499422bf28ddd862735a6a6ddbdd39638196c6a0b73556226770","description":"Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts.(Citation: VectorSec ForFiles Aug 2017)(Citation: Evi1cg Forfiles Nov 2017)(Citation: Secure Team - Scriptrunner.exe)(Citation: SS64)(Citation: Bleeping Computer - Scriptrunner.exe) Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file.(Citation: Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot)\n\nAdversaries may abuse these features for [Stealth](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1202","external_id":"T1202"},{"source_name":"Bleeping Computer - Scriptrunner.exe","description":"Bill Toulas. (2023, January 4). Hackers abuse Windows error reporting tool to deploy malware. Retrieved July 8, 2024.","url":"https://www.bleepingcomputer.com/news/security/hackers-abuse-windows-error-reporting-tool-to-deploy-malware/"},{"source_name":"Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot","description":"Cyble. (2024, December 5). Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot. Retrieved February 4, 2025.","url":"https://cyble.com/blog/threat-actor-targets-manufacturing-industry-with-malware/"},{"source_name":"Evi1cg Forfiles Nov 2017","description":"Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved September 12, 2024.","url":"https://x.com/Evi1cg/status/935027922397573120"},{"source_name":"Secure Team - Scriptrunner.exe","description":"Secure Team - Information Assurance. (2023, January 8). Windows Error Reporting Tool Abused to Load Malware. Retrieved July 8, 2024.","url":"https://secureteam.co.uk/2023/01/08/windows-error-reporting-tool-abused-to-load-malware/"},{"source_name":"SS64","description":"SS64. (n.d.). ScriptRunner.exe. Retrieved July 8, 2024.","url":"https://ss64.com/nt/scriptrunner.html"},{"source_name":"VectorSec ForFiles Aug 2017","description":"vector_sec. (2017, August 11). Defenders watching launches of cmd? What about forfiles?. Retrieved September 12, 2024.","url":"https://x.com/vector_sec/status/896049052642533376"}],"platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","domain":"enterprise","platforms":["Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1202","technique_page":"techniques/enterprise/T1202/","page":"detections/enterprise/T1202/","status":"rule_source_available","counts":{"sigma":39,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"ec8c4047-fad9-416a-8c81-0f479353d7f6","title":"Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE","status":"test","level":"high","logsource":{"category":"image_load","product":"windows"},"data_path":"data/detection-rules/ec8c4047-fad9-416a-8c81-0f479353d7f6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml","author":"Greg (rule)","kind":"sigma"},{"id":"03409c93-a7c7-49ba-9a4c-a00badf2a153","title":"Troubleshooting Pack Cmdlet Execution","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/03409c93-a7c7-49ba-9a4c-a00badf2a153.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"5edc2273-c26f-406c-83f3-f4d948e740dd","title":"Indirect Inline Command Execution Via Bash.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5edc2273-c26f-406c-83f3-f4d948e740dd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bash_command_execution.yml","author":"frack113","kind":"sigma"},{"id":"2d22a514-e024-4428-9dba-41505bd63a5b","title":"Indirect Command Execution From Script File Via Bash.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2d22a514-e024-4428-9dba-41505bd63a5b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bash_file_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"811f459f-9231-45d4-959a-0266c6311987","title":"Suspicious Child Process Of BgInfo.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/811f459f-9231-45d4-959a-0266c6311987.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"aaf46cdc-934e-4284-b329-34aa701e3771","title":"Uncommon Child Process Of BgInfo.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/aaf46cdc-934e-4284-b329-34aa701e3771.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml","author":"Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community","kind":"sigma"},{"id":"f37aba28-a9e6-4045-882c-d5004043b337","title":"Potential Arbitrary File Download Via Cmdl32.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f37aba28-a9e6-4045-882c-d5004043b337.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml","author":"frack113","kind":"sigma"},{"id":"3037d961-21e9-4732-b27a-637bcc7bf539","title":"Suspicious High IntegrityLevel Conhost Legacy Option","status":"test","level":"informational","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/3037d961-21e9-4732-b27a-637bcc7bf539.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_conhost_legacy_option.yml","author":"frack113","kind":"sigma"},{"id":"7dc2dedd-7603-461a-bc13-15803d132355","title":"Uncommon Child Process Of Conhost.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7dc2dedd-7603-461a-bc13-15803d132355.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml","author":"omkar72","kind":"sigma"},{"id":"dfa03a09-8b92-4d83-8e74-f72839b1c407","title":"Potentially Suspicious Child Processes Spawned by ConHost","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/dfa03a09-8b92-4d83-8e74-f72839b1c407.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"33339be3-148b-4e16-af56-ad16ec6c7e7b","title":"Findstr Launching .lnk File","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/33339be3-148b-4e16-af56-ad16ec6c7e7b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_findstr_lnk.yml","author":"Trent Liffick","kind":"sigma"},{"id":"06b401f4-107c-4ff9-947f-9ec1e7649f1e","title":"Potential Arbitrary Command Execution Via FTP.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/06b401f4-107c-4ff9-947f-9ec1e7649f1e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml","author":"Victor Sergeev, oscd.community","kind":"sigma"},{"id":"90dcf730-1b71-4ae7-9ffc-6fcf62bd0132","title":"Suspicious ZipExec Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/90dcf730-1b71-4ae7-9ffc-6fcf62bd0132.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_zipexec.yml","author":"frack113","kind":"sigma"},{"id":"eca49c87-8a75-4f13-9c73-a5a29e845f03","title":"Suspicious Runscripthelper.exe","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/eca49c87-8a75-4f13-9c73-a5a29e845f03.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml","author":"Victor Sergeev, oscd.community","kind":"sigma"},{"id":"258fc8ce-8352-443a-9120-8a11e4857fa5","title":"Potential Arbitrary Command Execution Using Msdt.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/258fc8ce-8352-443a-9120-8a11e4857fa5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"dc4576d4-7467-424f-9eee-fd2b02855fe0","title":"Suspicious Cabinet File Execution Via Msdt.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/dc4576d4-7467-424f-9eee-fd2b02855fe0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml","author":"Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113","kind":"sigma"},{"id":"4ae3e30b-b03f-43aa-87e3-b622f4048eed","title":"Potential Arbitrary File Download Using Office Application","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4ae3e30b-b03f-43aa-87e3-b622f4048eed.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml","author":"Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community","kind":"sigma"},{"id":"f99abdf0-6283-4e71-bd2b-b5c048a94743","title":"Potentially Suspicious Office Document Executed From Trusted Location","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f99abdf0-6283-4e71-bd2b-b5c048a94743.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"55f0a3a1-846e-40eb-8273-677371b8d912","title":"Outlook EnableUnsafeClientMailRules Setting Enabled","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/55f0a3a1-846e-40eb-8273-677371b8d912.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"e212d415-0e93-435f-9e1a-f29005bb4723","title":"Suspicious Remote Child Process From Outlook","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e212d415-0e93-435f-9e1a-f29005bb4723.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"f7375e28-5c14-432f-b8d1-1db26c832df3","title":"Potential Arbitrary DLL Load Using Winword","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f7375e28-5c14-432f-b8d1-1db26c832df3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_winword_dll_load.yml","author":"Victor Sergeev, oscd.community","kind":"sigma"},{"id":"7530cd3d-7671-43e3-b209-976966f6ea48","title":"Renamed CURL.EXE Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7530cd3d-7671-43e3-b209-976966f6ea48.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_curl.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"340a090b-c4e9-412e-bb36-b4b16fe96f9b","title":"Renamed ZOHO Dctask64 Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/340a090b-c4e9-412e-bb36-b4b16fe96f9b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_dctask64.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"277a4393-446c-449a-b0ed-7fdc7795244c","title":"Renamed FTP.EXE Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/277a4393-446c-449a-b0ed-7fdc7795244c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_ftp.yml","author":"Victor Sergeev, oscd.community","kind":"sigma"},{"id":"264982dc-dbad-4dce-b707-1e0d3e0f73d9","title":"Renamed NirCmd.EXE Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/264982dc-dbad-4dce-b707-1e0d3e0f73d9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_nircmd.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"c4e49831-1496-40cf-8ce1-b53f942b02f9","title":"Renamed PAExec Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c4e49831-1496-40cf-8ce1-b53f942b02f9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_paexec.yml","author":"Florian Roth (Nextron Systems), Jason Lynch","kind":"sigma"},{"id":"2433a154-bb3d-42e4-86c3-a26bdac91c45","title":"Renamed PingCastle Binary Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2433a154-bb3d-42e4-86c3-a26bdac91c45.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","kind":"sigma"},{"id":"1775e15e-b61b-4d14-a1a3-80981298085a","title":"Rundll32 Execution Without CommandLine Parameters","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1775e15e-b61b-4d14-a1a3-80981298085a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_no_params.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"835e75bf-4bfd-47a4-b8a6-b766cac8bcb7","title":"Uncommon Child Process Of Setres.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/835e75bf-4bfd-47a4-b8a6-b766cac8bcb7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_setres_uncommon_child_process.yml","author":"@gott_cyber, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"762bb580-79b4-40f4-8b9e-9349ce1710f4","title":"Indirect Command Execution via SFTP ProxyCommand","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/762bb580-79b4-40f4-8b9e-9349ce1710f4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sftp_proxy_command_execution.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"1f1a8509-2cbb-44f5-8751-8e1571518ce2","title":"Suspicious Splwow64 Without Params","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1f1a8509-2cbb-44f5-8751-8e1571518ce2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_splwow64_cli_anomaly.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"883faa95-175a-4e22-8181-e5761aeb373c","title":"Suspicious Service Binary Directory","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/883faa95-175a-4e22-8181-e5761aeb373c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_service_dir.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"7cce6fc8-a07f-4d84-a53e-96e1879843c9","title":"Potential Binary Impersonating Sysinternals Tools","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7cce6fc8-a07f-4d84-a53e-96e1879843c9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"5a3164f2-b373-4152-93cf-090b13c12d27","title":"Potentially Suspicious Child Process Of VsCode","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5a3164f2-b373-4152-93cf-090b13c12d27.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d7c75059-2901-4578-b209-8837fd31c6a8","title":"Proxy Execution via Vshadow","status":"experimental","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/d7c75059-2901-4578-b209-8837fd31c6a8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vshadow_exec.yml","author":"David Faiss","kind":"sigma"},{"id":"2267fe65-0681-42ad-9a6d-46553d3f3480","title":"WSL Child Process Anomaly","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2267fe65-0681-42ad-9a6d-46553d3f3480.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"6f1a11aa-4b8a-4b7f-9e13-4d3e4ff0e0d4","title":"WSL Kali-Linux Usage","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6f1a11aa-4b8a-4b7f-9e13-4d3e4ff0e0d4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wsl_kali_linux_usage.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"ed825c86-c009-4014-b413-b76003e33d35","title":"Windows Binary Executed From WSL","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ed825c86-c009-4014-b413-b76003e33d35.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wsl_windows_binaries_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"7530b96f-ad8e-431d-a04d-ac85cc461fdc","title":"Custom File Open Handler Executes PowerShell","status":"test","level":"high","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/7530b96f-ad8e-431d-a04d-ac85cc461fdc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml","author":"CD_R0M_","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0200","name":"Indirect Command Execution – Windows utility abuse behavior chain","url":"https://attack.mitre.org/detectionstrategies/DET0200","stix_id":"x-mitre-detection-strategy--f3cc2f0f-c657-4453-90a8-d7c9a59d6e37","relationship_id":"relationship--8bb1b5ae-824e-41f2-b3a3-f852e8c9bffe","description":"","analytics":[{"id":"AN0576","name":"Analytic 0576","guidance":"Cause→effect chain: (1) A user or service launches an indirection utility (e.g., forfiles.exe, pcalua.exe, wsl.exe, scriptrunner.exe, ssh.exe with -o ProxyCommand/LocalCommand). (2) That utility spawns a secondary program/command (PowerShell, cmd, msiexec, regsvr32, curl, arbitrary EXE) and/or opens outbound network connections. (3) Optional precursor modification of SSH config to persist LocalCommand/ProxyCommand. Correlate process creation, command/script content, file access to %USERPROFILE%\\.ssh\\config, and network connections from the utility or its child.","url":"https://attack.mitre.org/detectionstrategies/DET0200#AN0576","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlation window between indirect launcher and spawned child/network activity (e.g., 10–30 minutes)."},{"field":"AllowedUtilities","description":"Utilities permitted on admin/Jumphosts (forfiles, wsl, ssh) to reduce noise."},{"field":"HighRiskChildren","description":"Child images that indicate abuse (powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, mshta.exe, msiexec.exe, curl.exe, bitsadmin.exe)."},{"field":"UserContext","description":"Raise severity when the actor is a standard/interactive user on a workstation rather than a server or CI agent."},{"field":"DestCIDRs","description":"Known-good egress networks for SSH/WSL activity to suppress expected admin automations."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0576","source_url":"https://attack.mitre.org/detectionstrategies/DET0200#AN0576","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0576","source_url":"https://attack.mitre.org/detectionstrategies/DET0200#AN0576","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0576","source_url":"https://attack.mitre.org/detectionstrategies/DET0200#AN0576","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]}]}],"telemetry_references":[{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0193","name":"Forfiles","page":"tools/S0193/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0193","name":"Forfiles","page":"tools/S0193/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0193","name":"Forfiles","url":"https://attack.mitre.org/software/S0193","kind":"tool","description":"[Forfiles](https://attack.mitre.org/software/S0193) can be used to subvert controls and possibly conceal command execution by not directly invoking [cmd](https://attack.mitre.org/software/S0106).(Citation: VectorSec ForFiles Aug 2017)(Citation: Evi1cg Forfiles Nov 2017)","relationship_id":"relationship--8b746637-fef8-474e-8960-822d758fb9b3","references":[{"source_name":"Evi1cg Forfiles Nov 2017","description":"Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved September 12, 2024.","url":"https://x.com/Evi1cg/status/935027922397573120"},{"source_name":"VectorSec ForFiles Aug 2017","description":"vector_sec. (2017, August 11). Defenders watching launches of cmd? What about forfiles?. Retrieved September 12, 2024.","url":"https://x.com/vector_sec/status/896049052642533376"}]},{"id":"S0379","name":"Revenge RAT","url":"https://attack.mitre.org/software/S0379","kind":"malware","description":"[Revenge RAT](https://attack.mitre.org/software/S0379) uses the [Forfiles](https://attack.mitre.org/software/S0193) utility to execute commands on the system.(Citation: Cofense RevengeRAT Feb 2019)","relationship_id":"relationship--b5612c39-e246-409b-97cb-57067cfa27b4","references":[{"source_name":"Cofense RevengeRAT Feb 2019","description":"Gannon, M. (2019, February 11). With Upgrades in Delivery and Support Infrastructure, Revenge RAT Malware is a Bigger Threat. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200428173819/https://cofense.com/upgrades-delivery-support-infrastructure-revenge-rat-malware-bigger-threat/"}]}],"actors":[{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) persistence mechanisms have used <code>forfiles.exe</code> to execute .htm files.(Citation: Qualys LolZarus)","relationship_id":"relationship--09710ce1-9ed9-4c25-a86f-0a481174cc0d","references":[{"source_name":"Qualys LolZarus","description":"Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has used pcalua.exe to obfuscate binary execution and remote connections.(Citation: trendmicro_redcurl) ","relationship_id":"relationship--c23b4166-ede8-4ad6-bb31-40ce550a4107","references":[{"source_name":"trendmicro_redcurl","description":"Tancio et al. (2024, March 6). Unveiling Earth Kapre aka RedCurl’s Cyberespionage Tactics With Trend Micro MDR, Threat Intelligence. Retrieved August 9, 2024.","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]}],"mitigations":[],"candidates":[{"id":"0fd14730-6226-4f5e-8d67-43c65f1be940","name":"Indirect Command Execution - Scriptrunner.exe","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml","description":"The \"ScriptRunner.exe\" binary can be abused to proxy execution through it and bypass possible whitelisting. Upon test execution, calc.exe should open\nReference: https://x.com/NickTyrer/status/914234924655312896","inputs":{"payload_path":{"description":"Path to the executable","type":"String","default":"C:\\Windows\\System32\\calc.exe"}},"dependencies":[],"source_definition_sha256":"60c552024b57ba37e810c3fae5e8d69d55fc54b54bfff068c2ca9b24c88b53d1"},{"id":"8b34a448-40d9-4fc3-a8c8-4bb286faf7dc","name":"Indirect Command Execution - forfiles.exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml","description":"forfiles.exe may invoke the execution of programs and commands from a Command-Line Interface.\n[Reference](https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Forfiles.yml)\n\"This is basically saying for each occurrence of notepad.exe in c:\\windows\\system32 run calc.exe\"\nUpon execution calc.exe will be opened.\n","inputs":{"process":{"description":"Process to execute","type":"string","default":"calc.exe"}},"dependencies":[],"source_definition_sha256":"d83cf0c138a95510106ea70568910088a17500f29caacef4c2ce6def9698e031"},{"id":"cecfea7a-5f03-4cdd-8bc8-6f7c22862440","name":"Indirect Command Execution - pcalua.exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml","description":"The Program Compatibility Assistant (pcalua.exe) may invoke the execution of programs and commands from a Command-Line Interface.\n[Reference](https://twitter.com/KyleHanslovan/status/912659279806640128)\nUpon execution, calc.exe should open\n","inputs":{"payload_path":{"description":"Path to payload","type":"path","default":"C:\\Windows\\System32\\calc.exe"},"process":{"description":"Process to execute","type":"string","default":"calc.exe"}},"dependencies":[],"source_definition_sha256":"bbf7636b90214ae4f79db3c19331a57e63e466c6400019af676123ece910ad8d"},{"id":"cf3391e0-b482-4b02-87fc-ca8362269b29","name":"Indirect Command Execution - conhost.exe","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml","description":"conhost.exe refers to a host process for the console window. It provide an interface between command prompt and Windows explorer.\nExecuting it through command line can create process ancestry anomalies\n[Reference] (http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/)\n","inputs":{"process":{"description":"Process to execute","type":"string","default":"notepad.exe"}},"dependencies":[],"source_definition_sha256":"7b32ea70d91724399d471a590f111ff49b24194c75a41c2cdd043055433bb9e3"},{"id":"de323a93-2f18-4bd5-ba60-d6fca6aeff76","name":"Indirect Command Execution - RunMRU Dialog","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1202/T1202.yaml","description":"Simulates execution of commands via the Windows Run dialog (Win+R) by programmatically opening the Run dialog, \ncopying a command to clipboard, and automating the paste and execution. This generates artifacts in the RunMRU registry key,\nwhich is commonly abused by threat actors to execute malicious commands disguised as CAPTCHA verification steps.\nUpon execution, a test PowerShell command will be executed through the Run dialog.\n","inputs":{"command":{"description":"Command to execute via Run dialog","type":"string","default":"calc.exe"}},"dependencies":[],"source_definition_sha256":"246f2043c81a418ee5dbca7d3b4e9751b70f9f216cbcb456bd657ab44e22764f"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1059":"/ttp-simulation/techniques/enterprise/T1059/","T1202":"/ttp-simulation/techniques/enterprise/T1202/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1202","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}