How to create process chain

[DefenderLab]

I want to create process chain like below:
winword.exe->mshta.exe->powershell.exe

I have renamed cmd.exe with above names and using /c parameter like:
winword.exe /c mshta.exe "/c powershell.exe"

but it doesn't work. Do you have any idea?

[Ross Wolf]

Generally with cmd /c, I've had the best luck with minimal quotes. I believe it passes the rest of the command line as is.

If you're using the common module, this should work

import common
common.execute(["winword.exe", "/c", "mshta.exe", "/c", "powershell.exe"])

If you want to pass arguments to powershell, try appending them to array:

import common
common.execute(["winword.exe", "/c", "mshta.exe", "/c", "powershell.exe", "-Command", "whoami"])

[DefenderLab]

Thanks, It is working.