Techniques › T1059 › T1059.003
T1059.003 Windows Command Shell
execution — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
46
Sigma rules tagged attack.t1059.003
6
KEV CVEs mapped here
<p>Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.</p><p>Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.</p><p>Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-49704 | Microsoft SharePoint | primary impact | Mapped | 2025-07-22 |
| CVE-2025-49706 | Microsoft SharePoint | secondary impact | Mapped | 2025-07-22 |
| CVE-2023-42793 | JetBrains TeamCity | primary impact | Mapped | 2023-10-04 |
| CVE-2023-27532 | Veeam Backup & Replication | primary impact | Mapped | 2023-08-22 |
| CVE-2021-40449 | Microsoft Windows | secondary impact | Mapped | 2021-11-17 |
| CVE-2021-22899 | Ivanti Pulse Connect Secure | primary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0202 Behavioral Detection of Windows Command Shell Execution v1.0
AN0578 WindowsDetects interactive or scripted abuse of cmd.exe, batch files, or shell invocation chains. Focuses on parent-child relationships (e.g., cmd.exe launched from unusual parents), anomalous command-line parameters, and chaining with discovery, credential access, or lateral movement behaviors.Tunable:
ParentProcessNameTimeWindowCommandLinePatternScriptStoragePathUserContext
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1059.003
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-07-23 · logsource: product=windows category=process_creation · 00ca75ab-d5ce-43be-b86c-55ff39c6abfc
Detects the launch of a child process via "conhost.exe" with the "--headless" flag.
The "--headless" flag hides the windows from the user upon execution.
Author: Florian Roth (Nextron Systems)
· 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Author: Matt Anderson (Huntress)
· 2024-07-23 · logsource: product=windows category=process_creation · 056c7317-9a09-4bd4-9067-d051312752ea
Detects the use of powershell commands from headless ConHost window.
The "--headless" flag hides the windows from the user upon execution.
Author: Thomas Patzke
· 2020-05-22 (modified 2023-11-06) · logsource: product=windows category=process_creation · 058f4380-962d-40a5-afce-50207d36d7e2
Detects various execution patterns of the CrackMapExec pentesting framework
Author: Ali Alwashali
· 2023-10-10 · logsource: product=windows service=application · 076ebe48-cc05-4d8f-9d41-89245cd93a14
Detects command execution via ScreenConnect RMM
Author: xknow @xknow_infosec, Tim Shelton
· 2020-06-11 (modified 2023-03-06) · logsource: product=windows category=process_creation · 087790e3-3287-436c-bccf-cbd0184a7db1
Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking
Author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)
· 2022-05-24 (modified 2023-02-22) · logsource: product=windows category=process_creation · 0a99eb3e-1617-41bd-b095-13dc767f3def
Detects the use of Jlaive to execute assemblies in a copied PowerShell
Author: Ali Alwashali
· 2023-10-10 · logsource: product=windows category=file_event · 0afecb6e-6223-4a82-99fb-bf5b981e92a5
Detects the creation of files in a specific location by ScreenConnect RMM.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
Author: X__Junior (Nextron Systems)
· 2023-04-04 (modified 2023-04-22) · logsource: product=windows category=process_creation · 0e9e6c63-1350-48c4-9fa1-7ccb235edc68
Detects Rorschach ransomware execution activity
Author: Nisarg Suthar
· 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
Author: faloker
· 2020-02-12 (modified 2022-06-07) · logsource: product=aws service=cloudtrail · 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
· 2019-01-16 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1ac8666b-046f-4201-8aba-1951aaec03a3
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-03-07 · logsource: product=windows category=process_creation · 241e802a-b65e-484f-88cd-c2dc10f9206d
Detect the use of "<" to read and potentially execute a file via cmd.exe
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2025-11-12 · logsource: product=windows category=process_creation · 2782fbd8-b662-4eb5-9962-5bfbfb671e7b
Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing.
This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection.
This behavior has been observed in various malicious lnk files.
Author: Florian Roth (Nextron Systems)
· 2019-02-24 (modified 2023-03-08) · logsource: product=windows category=process_creation · 2b30fa36-3a18-402f-a22d-bf4ce2189f35
Detects activity that could be related to Baby Shark malware
Author: Jason Rathbun (Blackpoint Cyber)
· 2025-04-17 · logsource: product=windows category=process_creation · 2d79e371-2a27-42de-87a4-b4213fc72a6a
Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-19 · logsource: product=windows category=network_connection · 2fdaf50b-9fd5-449f-ba69-f17248119af6
Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such network connections can also help identify potential malicious infrastructure used by threat actors
Author: Pushkarev Dmitry
· 2020-06-28 (modified 2025-12-03) · logsource: product=windows service=applocker · 401e5d00-b944-11ea-8f9a-00163ecd60ae
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Author: Florian Roth (Nextron Systems)
· 2022-02-25 (modified 2023-03-08) · logsource: product=windows category=process_creation · 42a993dd-bb3e-48c8-b372-4d6684c4106c
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Author: Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-04-10 · logsource: product=windows category=process_creation · 459628e3-1b00-4e9b-9e5b-7da8961aea35
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
Author: _pete_0, TheDFIRReport
· 2022-05-06 (modified 2023-01-30) · logsource: product=windows category=process_creation · 4f154fb6-27d1-4813-a759-78b93e0b9c48
Detects Cobalt Strike module/commands accidentally entered in CMD shell
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Author: heyyanu
· 2026-03-26 · logsource: product=windows service=applocker · 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-04-28 · logsource: product=windows category=process_creation · 5b304bcb-ac33-49d0-87af-fa1b3ca94333
Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential
exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-04-28 · logsource: product=linux category=file_event · 5b91409c-cb18-4ab6-ac75-c5759f998409
Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories,
which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.
Author: wagga, Jonhnathan Ribeiro, oscd.community
· 2020-01-12 (modified 2023-02-11) · logsource: product=windows category=process_creation · 5cddf373-ef00-4112-ad72-960ac29bac34
Detects command line parameters used by Koadic hack tool
Author: Ali Alwashali
· 2023-10-10 · logsource: product=windows service=application · 5d19eb78-5b5b-4ef2-a9f0-4bfa94d58a13
Detects file being transferred via ScreenConnect RMM
Author: _pete_0, TheDFIRReport
· 2022-05-06 (modified 2023-01-30) · logsource: product=windows category=process_creation · 647c7b9e-d784-4fda-b9a0-45c565a7b729
Detects use of Cobalt Strike commands accidentally entered in the CMD shell
Author: Alex Walston (@4ayymm)
· 2024-07-29 · logsource: product=windows category=process_creation · 6676896b-2cce-422d-82af-5a1abe65e241
Detects potential APT FIN7 exploitation activity as reported by Google.
In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-04-28 · logsource: product=linux category=process_creation · 69dea60b-2deb-4c9e-a685-ad542f4367f9
Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential
exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=process_creation · 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities.
This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool.
Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.
Author: Florian Roth (Nextron Systems)
· 2020-03-25 (modified 2023-01-21) · logsource: product=windows category=process_creation · 846b866e-2a57-46ee-8e16-85fa92759be7
Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189
Author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-04-28 · logsource: product=windows category=file_event · 86a7c91f-98c3-4f14-a58d-d989421e1234
Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories,
which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.
Author: Alexander Rausch
· 2020-06-24 (modified 2023-03-01) · logsource: product=windows category=process_creation · 95022b85-ff2a-49fa-939a-d7b8f56eeb9b
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
Author: Ali Alwashali
· 2023-10-10 (modified 2024-02-26) · logsource: product=windows category=process_creation · b1f73849-6329-4069-bc8f-78a604bb8b23
Detects the execution of a system command via the ScreenConnect RMM service.
Author: frack113
· 2022-01-02 · logsource: product=windows category=ps_script · b5522a23-82da-44e5-9c8b-e10ed8955f88
Adversaries may abuse the Windows command shell for execution.
The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems.
The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands.
Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops.
Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
· 2018-03-01 (modified 2023-05-31) · logsource: product=windows category=process_creation · ba778144-5e3d-40cf-8af9-e28fb1df1e20
Detects Trojan loader activity as used by APT28
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-19 · logsource: product=windows category=dns_query · c082c2b0-525b-4dbc-9a26-a57dc4692074
Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.
Author: Florian Roth (Nextron Systems)
· 2022-01-20 (modified 2023-02-21) · logsource: product=windows category=process_creation · d2b749ee-4225-417e-b20e-a8d2193cbb84
Detects the execution of AdvancedRun utility
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2018-01-31 (modified 2023-03-09) · logsource: product=windows category=process_creation · e507feb7-5f73-4ef6-a970-91bb6f6d744f
Detects Elise backdoor activity used by APT32
Author: Alejandro Houspanossian ('@lekz86')
· 2024-01-02 · logsource: product=windows category=process_creation · e5144106-8198-4f6e-bfc2-0a551cc8dd94
Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads.
Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files.
In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.
Author: Maxim Pavlunin
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · e8a95b5e-c891-46e2-b33a-93937d3abc31
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-14 · logsource: product=windows category=process_creation · ee5e119b-1f75-4b34-add8-3be976961e39
detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2017-07-20 (modified 2021-11-27) · logsource: product=windows category=process_creation · f0b70adb-0075-43b0-9745-e82a1c608fcc
Detects a ZxShell start by the called and well-known function name
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=windows category=process_creation · f6c27ecc-d890-4452-80e6-2e274a10e097
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.
Rules tagged at the parent level (attack.t1059) 95
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Author: Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Author: Florian Roth (Nextron Systems)
· 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Author: frack113, Tim Shelton (update fp)
· 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2024-03-22 · logsource: product=windows category=process_creation · 24474469-bd80-46cc-9e08-9fbe81bfaaca
Detects the execution of a Word document via the WinWord Start Menu shortcut.
This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.
Author: Florian Roth (Nextron Systems)
· 2017-05-31 (modified 2022-10-09) · logsource: product=windows service=security · 24549159-ac1b-479c-8175-d42aea947cae
This events that are generated when using the hacktool Ruler by Sensepost
Author: Bhabesh Raj
· 2021-09-08 (modified 2023-02-13) · logsource: product=windows category=process_creation · 245f92e3-c4da-45f1-9070-bc552e06db11
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084
Author: Florian Roth (Nextron Systems), wagga
· 2020-12-23 (modified 2023-03-10) · logsource: product=windows category=process_creation · 24c4d154-05a4-4b99-b57d-9b977472443a
Detects different process execution behaviors as described in various threat reports on Lazarus group activity
Author: X__Junior (Nextron Systems)
· 2024-03-11 · logsource: product=windows category=process_creation · 264982dc-dbad-4dce-b707-1e0d3e0f73d9
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
· 2025-12-05 · logsource: product=windows category=process_creation · 271de298-cc0e-4842-acd8-079a0a99ea65
Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell).
Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync().
If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked.
For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2023-02-03) · logsource: product=windows category=process_creation · 277a4393-446c-449a-b0ed-7fdc7795244c
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Author: Florian Roth
· 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-31 (modified 2023-05-15) · logsource: product=windows category=process_creation · 2c28c248-7f50-417a-9186-a85b223010ee
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 2d2f44ff-4611-4778-a8fc-323a0e9850cc
Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
Author: Sreeman, Florian Roth (Nextron Systems), frack113
· 2020-04-21 (modified 2023-04-17) · logsource: product=windows category=process_creation · 313d6012-51a0-4d93-8dfc-de8553239e25
Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.
Author: @kostastsale
· 2023-06-01 · logsource: product=windows category=process_creation · 39ac1fb0-07f1-474b-b97e-c5c0eace0d79
Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files.
MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\Windows\\Microsoft\.NET\\Framework64\\v4\.0\.30319\\Temporary ASP\.NET Files\\root\\([a-z0-9]{5,12})\\([a-z0-9]{5,12})\\App_Web_[a-z0-9]{5,12}\.dll.
Hunting Opportunity
Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
· 2022-08-25 (modified 2023-03-05) · logsource: product=windows category=process_creation · 42333b2c-b425-441c-b70e-99404a17170f
Detects process activity patterns as seen being used by Sliver C2 framework implants
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 47b3bbd4-1bf7-48cc-84ab-995362aaa75a
Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Nextron Systems
· 2022-06-03 · logsource: product=windows category=process_creation · 480e7e51-e797-47e3-8d72-ebfce65b6d8d
Detects python spawning a pretty tty
Author: Tim Rauch, Elastic (idea)
· 2022-09-21 (modified 2023-12-05) · logsource: product=windows category=process_creation · 4b991083-3d0e-44ce-8fc4-b254025d8d4b
Detects suspicious parent process for cmd.exe
Author: @d4ns4n_
· 2023-04-24 · logsource: product=linux category=process_creation · 4e25af4b-246d-44ea-8563-e42aacab006b
Detects usage of "xterm" as a potential reverse shell tunnel
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 540703fb-a874-4385-a9d6-7cd1bfab268c
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
· 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · 55f0a3a1-846e-40eb-8273-677371b8d912
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
Author: bohops, Bhabesh Raj
· 2021-10-08 (modified 2023-07-25) · logsource: product=windows category=process_creation · 5687f942-867b-4578-ade7-1e341c46e99a
Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
Author: Ján Trenčanský
· 2020-07-28 · logsource: product=windows service=windefend · 57b649ef-ff42-4fb0-8bf6-62da243a1708
Detects actions taken by Windows Defender malware detection engines
Author: Florian Roth (Nextron Systems)
· 2021-07-03 (modified 2022-05-20) · logsource: product=windows category=process_creation · 5de632bc-7fbd-4c8a-944a-fce55c59eae5
Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2023-11-23 (modified 2025-03-06) · logsource: product=windows category=process_creation · 61065c72-5d7d-44ef-bf41-6a36684b545f
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-02-25 (modified 2024-07-12) · logsource: product=windows category=process_creation · 69bd9b97-2be2-41b6-9816-fb08757a4d1a
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Author: juju4
· 2019-01-16 (modified 2021-11-27) · logsource: product=windows category=process_creation · 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e
Detects suspicious process related to rasdial.exe
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=file_event · 6e90ae7a-7cd3-473f-a035-4ebb72d961da
Detects processes creating temp files related to PCRE.NET package
Author: Austin Songer
· 2021-09-21 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 72af37e2-ec32-47dc-992b-bc288a2708cb
Identifies when a new cloudshell is created inside of Azure portal.
Author: X__Junior (Nextron Systems)
· 2023-09-11 (modified 2023-10-12) · logsource: product=windows category=process_creation · 7530cd3d-7671-43e3-b209-976966f6ea48
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields
Author: X__Junior (Nextron Systems)
· 2023-07-11 · logsource: product=windows category=image_load · 799a5f48-0ac1-4e0f-9152-71d137d48c2a
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Author: pH-T (Nextron Systems)
· 2023-04-17 (modified 2024-11-23) · logsource: product=windows category=process_creation · 7a4d9232-92fc-404d-8ce1-4c92e7caf539
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-14 · logsource: product=windows category=process_creation · 7aa4e81a-a65c-4e10-9f81-b200eb229d7d
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
Author: @kostastsale
· 2023-07-16 · logsource: product=windows category=process_creation · 7aaa5739-12fc-41aa-b98b-23ec27d42bdf
Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.
Author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux
· 2022-12-28 (modified 2026-06-05) · logsource: product=linux category=process_creation · 7ab8f73a-fcff-428b-84aa-6a5ff7877dea
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: @d4ns4n_, Nasreddine Bencherchali (Nextron Systems)
· 2023-04-07 · logsource: product=linux category=process_creation · 7f734ed0-4f47-46c0-837f-6ee62505abd9
Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-03 · logsource: product=linux category=process_creation · 7fb14105-530e-4e2e-8cfb-99f7d8700b66
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134
Author: Rafal Piasecki
· 2022-08-10 (modified 2026-03-30) · logsource: product=linux service=auditd · 808146b2-9332-4d78-9416-d7e47012d83d
detects BPFDoor .lock and .pid files access in temporary file storage facility
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-16 · logsource: product=windows category=process_creation · 814c95cc-8192-4378-a70a-f1aafd877af1
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 · logsource: product=windows category=process_creation · 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=image_load · 84b0a8f3-680b-4096-a45b-e9a89221727c
Detects processes loading modules related to PCRE.NET package
Author: Florian Roth (Nextron Systems)
· 2022-03-24 (modified 2025-07-18) · logsource: product=windows category=process_creation · 85b0b087-eddf-4a2b-b033-d771fa2b9775
Detects PowerShell download and execution cradles.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-08-29 · logsource: product=linux category=process_creation · 8737b7f6-8df3-4bb7-b1da-06019b99b687
Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Florian Roth (Nextron Systems), @neonprimetime
· 2021-09-08 (modified 2023-02-04) · logsource: product=windows category=process_creation · 894397c6-da03-425c-a589-3d09e7d1f750
Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 (modified 2025-10-07) · logsource: product=windows category=process_creation · 899133d5-4d7c-4a7f-94ee-27355c879d90
Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 8c1a5675-cb85-452f-a298-b01b22a51856
Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function.
This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Micah Babinski
· 2025-11-25 · logsource: product=windows category=process_creation · 8e95e73e-ba02-4a87-b4d7-0929b8053038
Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.
ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS
Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding
service endpoint and remotely execute code from the ArcSOC.exe process.
Author: @kostastsale
· 2023-02-15 (modified 2024-08-13) · logsource: product=windows category=process_creation · 95724fc1-a258-4674-97db-a30351981c5a
This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries.
From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios.
1. Compressed file opened using 7zip.
2. Compressed file opened using WinRar.
3. Compressed file opened using native windows File Explorer capabilities.
When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."
Author: Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
· 2022-06-14 (modified 2024-03-05) · logsource: product=windows category=process_creation · 9aa5106d-bce3-4b13-86df-3a20f1d5cf0b
Detects the execution of "forfiles" with the "/c" flag.
While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary.
Can be used to bypass application whitelisting.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2022-02-15 (modified 2023-03-06) · logsource: product=windows category=process_creation · a77c1610-fc73-4019-8e29-0f51efc04a51
Detects possible payload obfuscation via the commandline
Author: Sreeman
· 2020-04-21 (modified 2022-03-08) · logsource: product=windows category=process_creation · ae9b0bd7-8888-4606-b444-0ed7410cb728
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.
Author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems)
· 2022-12-15 (modified 2024-01-02) · logsource: product=windows category=process_creation · afe52666-401e-4a02-b4ff-5d128990b8cb
Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-02 (modified 2024-04-23) · logsource: product=windows category=process_creation · b96b2031-7c17-4473-afe7-a30ce714db29
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-05 · logsource: product=windows category=file_event · bbb7e38c-0b41-4a11-b306-d2a457b7ac2b
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-02 (modified 2023-02-14) · logsource: product=windows category=process_creation · bdeeabc9-ff2a-4a51-be59-bb253aac7891
Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)
Author: frack113, The DFIR Report
· 2022-03-02 (modified 2025-11-13) · logsource: product=windows category=process_creation · c0b2768a-dd06-4671-8339-b16ca8d1f27f
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.
Author: Tim Rauch, Elastic (idea)
· 2022-09-16 (modified 2022-11-26) · logsource: product=windows category=ps_script · c1344fa2-323b-4d2e-9176-84b4d4821c88
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-04-17 (modified 2023-12-04) · logsource: product=windows category=process_creation · c15a46a0-07d4-4c87-b4b6-89207835a83b
Detects usage of winget to add new potentially suspicious download sources
Author: Nextron Systems
· 2022-06-03 (modified 2024-11-04) · logsource: product=linux category=process_creation · c4042d54-110d-45dd-a0e1-05c47822c937
Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.
Author: Markus Neis
· 2017-11-07 (modified 2022-10-09) · logsource: product=windows category=process_creation · c601f20d-570a-4cde-a7d6-e17f99cb8e7f
Detects automated lateral movement by Turla group
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
· 2025-12-05 · logsource: product=linux category=process_creation · c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7
Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell).
This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands.
When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>).
For other methods, the Image field will show the spawned process directly.
Author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community
· 2020-10-17 (modified 2021-11-27) · logsource: product=windows category=process_creation · c83bf4b5-cdf0-437c-90fa-43d734f7c476
Detects PowerShell script execution via input stream redirect
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 (modified 2025-03-06) · logsource: product=windows category=process_creation · cbb9e3d1-2386-4e59-912e-62f1484f7a89
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-03 · logsource: product=linux category=process_creation · d292e0af-9a18-420c-9525-ec0ac3936892
Detects java process spawning suspicious children
Author: Florian Roth (Nextron Systems)
· 2018-06-22 (modified 2021-11-27) · logsource: product=windows category=process_creation · d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · d81871ef-5738-47ab-9797-7a9c90cd4bfb
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · db1ac3be-f606-4e3a-89e0-9607cbe6b98a
Detects the use of the "capsh" utility to invoke a shell.
Author: Tomasz Dyduch, Josh Nickels
· 2024-05-31 · logsource: product=windows category=file_event · df49c691-8026-48dd-94d3-4ba6a79102a8
Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.
Author: Sohan G (D4rkCiph3r)
· 2023-02-18 · logsource: product=macos category=process_creation · e0cfaecd-602d-41af-988d-f6ccebb2af26
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
· 2018-12-27 (modified 2023-02-09) · logsource: product=windows category=process_creation · e212d415-0e93-435f-9e1a-f29005bb4723
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth
· 2024-09-02 (modified 2025-01-18) · logsource: product=linux category=process_creation · e2326866-609f-4015-aea9-7ec634e8aa04
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Bhabesh Raj
· 2020-09-14 (modified 2022-12-07) · logsource: product=windows service=windefend · ea9bf0fa-edec-4fb8-8b78-b119f2528186
Detects triggering of AMSI by Windows Defender.
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2022-07-11) · logsource: product=windows category=process_creation · eca49c87-8a75-4f13-9c73-a5a29e845f03
Detects execution of powershell scripts via Runscripthelper.exe
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-10 · logsource: product=windows category=process_creation · eca8ae39-5c3c-4321-b538-9e64fe25822e
Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).
Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
Author: Florian Roth (Nextron Systems)
· 2022-02-11 (modified 2023-03-22) · logsource: product=windows category=process_creation · efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-07-27 (modified 2023-03-29) · logsource: product=windows category=process_creation · f35c5d71-b489-4e22-a115-f003df287317
Detects potential process patterns related to Cobalt Strike beacon activity
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-02 · logsource: product=windows category=process_creation · f426547a-e0f7-441a-b63e-854ac5bdf54d
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Author: Andreas Braathen (mnemonic.io)
· 2023-11-14 · logsource: product=linux category=process_creation · f8987c03-4290-4c96-870f-55e75ee377f4
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Author: frack113
· 2022-03-12 · logsource: product=windows category=process_creation · f8ad2e2c-40b6-4117-84d7-20b89896ab23
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system
Author: Micah Babinski
· 2023-10-15 · logsource: product=windows category=process_creation · f8e9aa1c-14f2-4dbd-aa59-b98968ed650d
Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within
the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate
command-and-control server.
Author: X__Junior
· 2025-01-20 · logsource: product=windows category=image_load · fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.