huntrule

Windows Bash.exe Launched Without Script Execution Arguments

Alerts on bash.exe launched without script-execution flags, a potential stealthy way to run bash-driven payloads on Windows.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-08-15
Updated
2026-07-31
AnalysisDetection
title: Windows Bash.exe Launched Without Script Execution Arguments
id: 6157d88a-10d9-4222-9baa-4a1a548bef24
related:
  - id: 5edc2273-c26f-406c-83f3-f4d948e740dd
    type: similar
  - id: 2d22a514-e024-4428-9dba-41505bd63a5b
    type: derived
status: test
description: This rule flags process creation events where Microsoft bash.exe (System32 or SysWOW64) is started without any command-line arguments indicating a script execution mode. Attackers may use bash as an execution bridge to run Linux or cross-platform commands from a Windows context while reducing obvious script-processing command lines. It relies on Windows process creation telemetry, matching the bash.exe image path and OriginalFileName and then applying filters based on the CommandLine contents.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Bash/
  - https://linux.die.net/man/1/bash
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bash_file_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-15
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - :\Windows\System32\bash.exe
        - :\Windows\SysWOW64\bash.exe
    - OriginalFileName: Bash.exe
  filter_main_cli_flag:
    CommandLine|contains:
      - bash.exe -
      - bash -
  filter_main_no_cli:
    CommandLine: null
  filter_main_empty:
    CommandLine: ""
  filter_main_no_flag:
    CommandLine:
      - bash.exe
      - bash
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1