Windows Indirect Execution of bash.exe With -c Flag

title: Windows Indirect Execution of bash.exe With -c Flag
id: cd3e61c6-f362-424b-be10-8babcbcd99cc
related:
  - id: 2d22a514-e024-4428-9dba-41505bd63a5b
    type: similar
  - id: 5edc2273-c26f-406c-83f3-f4d948e740dd
    type: derived
status: test
description: This rule flags process creation where bash.exe is launched with the -c option, indicating inline command execution. Attackers can use bash -c to run Linux or Windows commands through the bash launcher in a way that may evade some controls. The detection relies on Windows process creation telemetry, matching the bash.exe binary path and the presence of ' -c ' in the command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Bash/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bash_command_execution.yml
author: frack113, Huntrule Team
date: 2021-11-24
modified: 2023-08-15
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - :\Windows\System32\bash.exe
        - :\Windows\SysWOW64\bash.exe
    - OriginalFileName: Bash.exe
  selection_cli:
    CommandLine|contains: " -c "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1