Suspicious Indirect Command Execution From Script File Through Bash.EXE (via process_creation)

title: Suspicious Indirect Command Execution From Script File Through Bash.EXE (via process_creation)
id: 46e470f2-56e2-59b8-bb67-c3475f25a713
status: stable
description: This rule detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly. This can be leveraged to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.
references:
    - https://attack.mitre.org/techniques/T1202/
    - https://lolbas-project.github.io/lolbas/Binaries/Bash/
    - https://linux.die.net/man/1/bash
    - Internal Research
author: Huntrule Team
date: 2026-07-25
tags:
    - attack.stealth
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith:
              - ':\Windows\System32\bash.exe'
              - ':\Windows\SysWOW64\bash.exe'
        - OriginalFileName: 'Bash.exe'
    filter_main_cli_flag:
        CommandLine|contains:
            - 'bash.exe -'
            - 'bash -'
    filter_main_no_cli:
        CommandLine:
    filter_main_empty:
        CommandLine: ''
    filter_main_no_flag:
        CommandLine:
            - 'bash.exe'
            - 'bash'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium