Windows Bash.exe Launched Without Script Execution Arguments
Alerts on bash.exe launched without script-execution flags, a potential stealthy way to run bash-driven payloads on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-15
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where Microsoft bash.exe (System32 or SysWOW64) is started without any command-line arguments indicating a script execution mode. Attackers may use bash as an execution bridge to run Linux or cross-platform commands from a Windows context while reducing obvious script-processing command lines. It relies on Windows process creation telemetry, matching the bash.exe image path and OriginalFileName and then applying filters based on the CommandLine contents.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Bash.exe Launched Without Script Execution Arguments
id: 6157d88a-10d9-4222-9baa-4a1a548bef24
related:
- id: 5edc2273-c26f-406c-83f3-f4d948e740dd
type: similar
- id: 2d22a514-e024-4428-9dba-41505bd63a5b
type: derived
status: test
description: This rule flags process creation events where Microsoft bash.exe (System32 or SysWOW64) is started without any command-line arguments indicating a script execution mode. Attackers may use bash as an execution bridge to run Linux or cross-platform commands from a Windows context while reducing obvious script-processing command lines. It relies on Windows process creation telemetry, matching the bash.exe image path and OriginalFileName and then applying filters based on the CommandLine contents.
references:
- https://lolbas-project.github.io/lolbas/Binaries/Bash/
- https://linux.die.net/man/1/bash
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bash_file_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-15
tags:
- attack.stealth
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- :\Windows\System32\bash.exe
- :\Windows\SysWOW64\bash.exe
- OriginalFileName: Bash.exe
filter_main_cli_flag:
CommandLine|contains:
- bash.exe -
- bash -
filter_main_no_cli:
CommandLine: null
filter_main_empty:
CommandLine: ""
filter_main_no_flag:
CommandLine:
- bash.exe
- bash
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1