Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts.12345 Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file.6 Adversaries may abuse these features for Stealth, specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of cmd or file extensions more commonly associated with malicious payloads.
- VectorSec ForFiles Aug 2017
- Evi1cg Forfiles Nov 2017
- Secure Team - Scriptrunner.exe
- SS64
- Bleeping Computer - Scriptrunner.exe
- Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0032 | Lazarus Group | DPRK |
| grp_g1039 | RedCurl | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.