Indirect Command Execution via Bash.exe Without Flags
This rule detects the execution of the Microsoft bash launcher (bash.exe) without any command-line flags. This behavior can be indicative of an adversary attempting to bypass security defenses by executing Linux or Windows-based binaries indirectly through bash, potentially leveraging it as a living-off-the-land binary (LOLBAS). The rule specifically looks for bash.exe being run without common flags like '-' or an empty command line, suggesting an attempt to execute a script or command without directly specifying it as an argument.
Sigma
