Patchfirst
Patchfirst
T1202Stealth

Indirect Command Execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as…

attack.mitre.org ↗
CVEs10
In 7
Reports0

Detections

41 Sigma rules tagged T1202
Indirect Command ExecutionT120241 general rules
All 41 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Indirect Command Execution

10 CVEs, by priority. Each link shows its badge.
  1. CVE-2019-3396Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
    Atlassian · Confluence Server and Data ServerKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1202Indirect Command Execution+1 more · 1 report
    MITRE CTID mapping of the KEV entry · follow-on activity
    99.9%Top 0.03%
    83.7priority
  2. CVE-2023-32315Ignite Realtime Openfire Path Traversal Vulnerability
    Ignite Realtime · OpenfireKEVPublic exploitHigh · 7.5T1505.003Web ShellT1202Indirect Command Execution+2 more · 1 report
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.01%
    82.1priority
  3. CVE-2022-29464WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
    WSO2 · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1202Indirect Command Execution+1 more
    MITRE CTID mapping of the KEV entry · primary impact
    >99.9%Top 0.01%
    79.9priority
  4. CVE-2023-40044Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
    Progress · WS_FTP ServerKEVRansomwarePublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1202Indirect Command Execution+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    90.4%Top 0.2%
    79.1priority
  5. CVE-2024-24919Check Point Quantum Security Gateways Information Disclosure Vulnerability
    Check Point · Quantum Security GatewaysKEVRansomwarePublic exploitHigh · 8.6T1059.004Unix ShellT1202Indirect Command Execution+3 more
    MITRE CTID mapping of the KEV entry · how it is exploited
    >99.9%Top 0.02%
    79.0priority
  6. CVE-2019-3398Atlassian Confluence Server and Data Center Path Traversal Vulnerability
    Atlassian · Confluence Server and Data CenterKEVPublic exploitHigh · 8.8T1059Command and Scripting InterpreterT1202Indirect Command Execution
    MITRE CTID mapping of the KEV entry · how it is exploited
    97.0%Top 0.11%
    69.1priority
  7. CVE-2013-0629Adobe ColdFusion Directory Traversal Vulnerability
    Adobe · ColdFusionKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1202Indirect Command Execution+1 more
    MITRE CTID mapping of the KEV entry · primary impact
    65.8%Top 0.73%
    68.1priority
  8. CVE-2018-17934NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be…
    Public exploitT1203Exploitation for Client ExecutionT1202Indirect Command Execution+2 more
    MITRE CTID mapping of the CVE · how it is exploited
    19.7%Top 2.6%
    24.5priority
  9. CVE-2018-10589In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard…
    Advantech · WebAccessT1202Indirect Command Execution
    MITRE CTID mapping of the CVE · primary impact
    3.9%Top 9.6%
    18.1priority
  10. CVE-2019-1270An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to…
    Microsoft · WindowsT1202Indirect Command ExecutionT1485Data Destruction+1 more
    MITRE CTID mapping of the CVE · how it is exploited
    0.9%Top 40%
    11.9priority
↑ ↓ chooseEnter openEsc close