Indirect Command Execution via Bash.exe with -c Flag

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the execution of Microsoft's bash launcher (bash.exe) with the "-c" flag. This technique can be used by adversaries to bypass defenses and execute Linux or Windows-based binaries indirectly via bash, leveraging the Windows Subsystem for Linux (WSL) environment.