MITRE ATT&CK T1202 Indirect Command Execution: Catching Commands Run Without cmd.exe

Blocking or monitoring cmd.exe and PowerShell does not stop command execution when a signed Windows utility can launch the same programs for the attacker. MITRE ATT&CK T1202 Indirect Command Execution covers adversaries abusing utilities that can run commands, so they bypass restrictions that limit command-line interpreters. ATT&CK names Forfiles, the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), Scriptrunner.exe and the ssh.exe ProxyCommand and LocalCommand options as examples. In ATT&CK v20 the technique sits in the Stealth tactic (TA0005) and applies to Windows. This guide covers how indirect launchers work as a detection problem, the behaviour chain ATT&CK recommends hunting, how to tune it, which preventive controls actually reach these utilities, and how to respond. It is for detection engineers, SOC analysts and endpoint engineers. WSL-specific controls are in the WSL Security Guide and the wider class of signed-binary abuse is in the Living off the Land Guide; this page does not repeat them.

Key takeaways

• The launcher is the clue, not the payload. The child process may be an ordinary PowerShell or msiexec run; what stands out is that forfiles, pcalua, scriptrunner, wsl or ssh started it.
• Interpreter blocks create the incentive. ATT&CK says the technique is used to subvert controls such as Group Policy that prevent cmd use, so every interpreter restriction you add should come with a launcher rule.
• Correlate three signals. ATT&CK's v20 analytic chains the launcher process, the child it spawns or the connection it opens, and any change to the user's SSH config file.
• Allowlist by host role. Forfiles and ssh have genuine admin uses on servers and jump hosts; the same launch on a standard user's workstation deserves a higher severity.
• Application control must name the utilities. Microsoft's recommended App Control block list covers wsl.exe, wslhost.exe and bash.exe but, as of November 2026, not forfiles.exe, pcalua.exe, scriptrunner.exe or ssh.exe, so add your own rules for those.

How indirect command execution works

Each utility in scope has a legitimate feature that runs another program. Forfiles, for example, runs a command on every file that matches a filter, and Microsoft's documentation shows its default command is itself a cmd invocation. An attacker uses that feature to start a program while the parent process recorded in telemetry is a trusted, signed utility rather than an interpreter. ATT&CK lists the abuse as a way to perform arbitrary execution while subverting detections and mitigation controls, including blocks on file extensions commonly associated with malicious payloads.

ATT&CK also notes that "other utilities" can serve the same purpose. Treat the list as a starting set and extend it from your own threat intelligence and from the T1218 System Binary Proxy Execution Defensive Guide, which covers signed binaries that proxy execution of code rather than commands.

How T1202 differs from neighbouring techniques

• T1059 Command and Scripting Interpreter: the interpreter itself is the execution vehicle. In T1202 the interpreter is avoided or hidden behind another utility. See the T1059 Command and Scripting Interpreter Defensive Guide.
• T1218 System Binary Proxy Execution: signed binaries such as mshta or rundll32 load and run code. T1202 utilities launch other programs or commands.
• T1564.006 Run Virtual Instance: running code inside a virtual instance such as WSL so host tools cannot see it. WSL can appear under both techniques.

Detection: the indirect launcher behaviour chain

ATT&CK v20 publishes detection strategy DET0200 for T1202 with one Windows analytic (AN0576). It describes a cause and effect chain: a user or service launches an indirection utility; that utility spawns a secondary program or command, or opens outbound network connections; and, optionally, the SSH config is modified first so that LocalCommand or ProxyCommand persists. The table lists the data ATT&CK names for each step.

Windows Security event 4688 with command-line auditing enabled can substitute for Sysmon event 1 where Sysmon is not deployed; an EDR process tree gives the same parent and child view. See the Sysmon Guide for configuration.

Tuning the analytic

ATT&CK lists the elements each organisation should tune. These are the levers that turn a noisy rule into one the SOC trusts.

• TimeWindow: the correlation window between the launcher and the child or network activity; ATT&CK suggests 10 to 30 minutes.
• AllowedUtilities: utilities permitted on admin servers and jump hosts (forfiles, wsl, ssh), so those hosts do not flood the queue.
• HighRiskChildren: child images that indicate abuse; ATT&CK lists powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, mshta.exe, msiexec.exe, curl.exe and bitsadmin.exe.
• UserContext: raise severity when the actor is a standard interactive user on a workstation rather than a server or CI agent.
• DestCIDRs: known-good egress networks for SSH and WSL activity, to suppress expected admin automation.

Severity guide

Prevention and hardening

ATT&CK v20 lists no specific mitigation objects for T1202, so prevention comes from general execution controls applied with the launchers in mind.

1. Extend application control rules to the launchers. Microsoft's recommended block rules for App Control for Business include bash.exe, wsl.exe, wslconfig.exe, wslhost.exe and lxssmanager.dll. Forfiles.exe, pcalua.exe, scriptrunner.exe and ssh.exe are not on that list as of November 2026, so where users have no need for them, add deny rules for standard user workstations. See the App Control for Business (WDAC) guide for policy design.
2. Restrict by path and parent, not just name. Copied or renamed system tools defeat name-based rules. Microsoft Defender's attack surface reduction rule "Block use of copied or impersonated system tools" (GUID c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb) addresses part of this; equivalent EDR policies exist in other products.
3. Block the common delivery parents. Indirect launchers are often started by a document, script or browser. The attack surface reduction rules "Block all Office applications from creating child processes" (d4f940ab-401b-4efc-aadc-ad5f3c50688a) and "Block JavaScript or VBScript from launching downloaded executable content" (d3e037e1-3eb8-44c8-a917-57927947596d) cut off those starting points.
4. Control OpenSSH client use. Where the Windows OpenSSH client is an optional feature, remove it from workstations that do not need it, and monitor the user SSH config file for command options on those that do.
5. Remove WSL where it is not approved. The WSL guide covers the feature-level controls.
6. Do not rely on interpreter blocks alone. A Group Policy that blocks cmd.exe without launcher rules shifts attackers to T1202 rather than stopping them.

Implementing T1202 coverage

1. Inventory legitimate use (week 1): query 30 days of process telemetry for each launcher, grouped by host role, parent, child and account. Record the scheduled tasks, deployment tools and admin scripts that use them.
2. Deploy the analytic in log-only mode (weeks 2 to 3): implement the AN0576 chain with your allowlists, measure daily volume and review every hit.
3. Tune and promote (week 4): move high-confidence variants (pcalua and scriptrunner with high-risk children, SSH config changes on workstations) to alerting with a runbook.
4. Pilot application control (weeks 4 to 8): add launcher deny rules to an audit-mode App Control policy on a pilot ring of standard user devices; review audit events, then enforce. Roll back by redeploying the previous policy version.
5. Test (ongoing): run authorised adversary emulation for T1202 in a test environment each quarter and confirm both the alert and the block fire.

Smaller organisations without a SIEM can still get most of the value from EDR custom detections on the parent and child pair and from application control on workstations. Larger estates should split the rule by host role, since server and workstation baselines differ sharply.

Responding to an alert

• Establish lineage: walk the process tree up from the launcher to find what started it (document, script, scheduled task, remote session) and down to everything the child did.
• Check for persistence: review scheduled tasks, Run keys and the user's SSH config for entries that invoke the launcher; ATT&CK records forfiles being used in persistence mechanisms.
• Scope the network side: collect connection and DNS records for the launcher and child, and search the estate for the same destinations.
• Contain: isolate the host through EDR if the child made external connections or dropped files; disable the account if it was used interactively by the attacker.
• Preserve evidence: keep the process tree, command lines, the SSH config file and any dropped files before cleaning.
• Close the gap: add the utility to application control for that host class and update the allowlist if the alert was legitimate.

Where identity fits

The ssh.exe variant ties T1202 to machine credentials. A workstation with an SSH config file usually holds private keys, and a planted LocalCommand runs every time the user connects with those keys. Treat SSH keys on endpoints as non-human credentials: inventory them, restrict where they are stored and rotate any key present on a host where the SSH config was tampered with. See the T1059 guide for interpreter controls that apply once the attacker has a shell.

Measuring it

• Launcher telemetry coverage: percentage of Windows endpoints sending process creation events with parent image and command line (target 100 percent of managed endpoints).
• Allowlist completeness: number of launcher executions per week from host and parent pairs not on the allowlist (should trend towards a small, reviewed set).
• Application control reach: percentage of standard user workstations with launcher deny rules enforced.
• Emulation detection rate: share of quarterly T1202 emulation runs that produced an alert within the SOC's target time.
• Mean time to triage: time from launcher alert to a confirmed benign or malicious verdict.

Common failure patterns

• Interpreter-only detections: rules that alert on cmd.exe and powershell.exe parents but never look at what started them.
• Allowlisting by binary name: exempting forfiles.exe estate-wide because one server script uses it.
• Relying on the vendor block list as complete: assuming Microsoft's recommended block rules cover every launcher, when several named by ATT&CK are absent.
• Ignoring SSH config files: monitoring ssh.exe command lines but not the config file where options persist.
• No host-role context: treating a developer workstation, a jump host and a call-centre desktop the same, which either floods the queue or hides the attack.

Framework mapping

Practitioner checklist

• Collect process creation events with parent image and full command line on every Windows endpoint.
• Deploy the ATT&CK AN0576 behaviour chain with allowlists by host role.
• Alert on pcalua.exe and scriptrunner.exe spawning high-risk children.
• Monitor writes to user SSH config files that add LocalCommand or ProxyCommand.
• Add forfiles, pcalua, scriptrunner and ssh deny rules to application control on standard user workstations, after an audit pilot.
• Enable attack surface reduction rules that block Office and script hosts from launching child processes.
• Rotate SSH keys on any host where the SSH config was tampered with.
• Run a T1202 emulation each quarter and record whether it was detected and blocked.

Standards and references

• MITRE ATT&CK: Indirect Command Execution (T1202)
• MITRE ATT&CK: Forfiles (S0193)
• Microsoft Learn: forfiles
• Microsoft Learn: Applications that can bypass App Control and how to block them
• Microsoft Learn: Attack surface reduction rules reference
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Living off the Land Guide · WSL Security Guide · T1218 System Binary Proxy Execution Defensive Guide · App Control for Business (WDAC) · ATT&CK Stealth and Defense Impairment Tactics Guide