Windows bash.exe Launched with -c for Indirect Inline Command Execution

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation where bash.exe is invoked with the "-c" flag, using either the 64-bit or 32-bit launcher path. Attackers can use this behavior to run inline commands through a shell context, potentially complicating monitoring and enabling direct execution workflows. It relies on Windows process creation telemetry, specifically the executable image path/name and the command line containing " -c ".

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows SFTP.exe Indirect Command Execution via ProxyCommand

WSL Process Execution of Kali Linux on Windows

Windows vshadow.exe Proxy Execution via -exec Script/Command

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows Bash.exe Launched Without Script Execution Arguments

Windows bash.exe Launched with -c for Indirect Inline Command Execution

Pivot detection · T1202 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-indirect-execution-of-bash-exe-with-c-flag-5edc2273

title: Windows bash.exe Launched with -c for Indirect Inline Command Execution
id: cd3e61c6-f362-424b-be10-8babcbcd99cc
related:
  - id: 2d22a514-e024-4428-9dba-41505bd63a5b
    type: similar
  - id: 5edc2273-c26f-406c-83f3-f4d948e740dd
    type: derived
status: test
description: This rule identifies process creation where bash.exe is invoked with the "-c" flag, using either the 64-bit or 32-bit launcher path. Attackers can use this behavior to run inline commands through a shell context, potentially complicating monitoring and enabling direct execution workflows. It relies on Windows process creation telemetry, specifically the executable image path/name and the command line containing " -c ".
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Bash/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bash_command_execution.yml
author: frack113, Huntrule Team
date: 2021-11-24
modified: 2023-08-15
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - :\Windows\System32\bash.exe
        - :\Windows\SysWOW64\bash.exe
    - OriginalFileName: Bash.exe
  selection_cli:
    CommandLine|contains: " -c "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL