Command and Scripting Interpreter: Windows Command Shell T1059.003

Events covered

27 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 148 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (72 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (1071 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (266 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 48 rules

• AppLocker Prevented Application or Script from Running
• AWS EC2 Startup Shell Script Change
• Axios NPM Compromise Indicators - Windows
• Command Line Execution with Suspicious URL and AppData Strings
• Conhost.exe CommandLine Path Traversal
• DNS Query by Finger Utility
• Elise Backdoor Activity
• Encoded PowerShell payload deployed via process execution
• Exploited CVE-2020-10189 Zoho ManageEngine
• Exploiting SetupComplete.cmd CVE-2019-1378
• HackTool - CrackMapExec Execution
• HackTool - CrackMapExec Execution Patterns
• HackTool - Jlaive In-Memory Assembly Execution
• HackTool - Koadic Execution
• HackTool - RedMimicry Winnti Playbook Execution
• Headless Process Launched Via Conhost.EXE
• HTML Help HH.EXE Suspicious Child Process
• Metasploit reverse shell injection in SQL Server
• Network Connection Initiated via Finger.EXE
• OpenEDR Spawning Command Shell
• Operator Bloopers Cobalt Strike Commands
• Operator Bloopers Cobalt Strike Modules
• Potential APT FIN7 Exploitation Activity
• Potential Baby Shark Malware Activity
• Potential CommandLine Path Traversal Via Cmd.EXE
• Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
• Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE
• Potential SAP NetWeaver Webshell Creation
• Potential SAP NetWeaver Webshell Creation - Linux
• Powershell Execute Batch Script
• Powershell Executed From Headless ConHost Process
• PUA - AdvancedRun Execution
• Read Contents From Stdin Via Cmd.EXE
• Remote Access Tool - ScreenConnect Command Execution
• Remote Access Tool - ScreenConnect File Transfer
• Remote Access Tool - ScreenConnect Remote Command Execution
• Remote Access Tool - ScreenConnect Temporary File
• Rorschach Ransomware Execution Activity
• Serial console process spawning CMD shell (via command)
• Sofacy Trojan Loader Activity
• Suspicious Child Process of SAP NetWeaver
• Suspicious Child Process of SAP NetWeaver - Linux
• Suspicious CrushFTP Child Process
• Suspicious HH.EXE Execution
• Suspicious HWP Sub Processes
• Suspicious Process Spawned by CentreStack Portal AppPool
• Suspicious Usage of For Loop with Recursive Directory Search in CMD
• ZxShell Malware

Elastic 42 rules

• Binary Content Copy via Cmd.exe
• Command and Scripting Interpreter via Windows Scripts
• Command Execution via SolarWinds Process
• Command Shell Activity Started via RunDLL32
• Delayed Execution via Ping
• Execution from Unusual Directory - Command Line
• Execution of a Downloaded Windows Script
• Execution via GitHub Actions Runner
• Execution via MS VisualStudio Pre/Post Build Events
• Execution via MSSQL xp_cmdshell Stored Procedure
• Execution via OpenClaw Agent
• Microsoft Build Engine Started by a Script Process
• Microsoft Exchange Worker Spawning Suspicious Processes
• Potential Command Shell via NetCat
• Potential Execution via FileFix Phishing Attack
• Potential Fake CAPTCHA Phishing Attack
• Potential SAP NetWeaver Exploitation
• Potential SharpRDP Behavior
• Process Activity via Compiled HTML File
• Proxy Execution via Console Window Host
• ScreenConnect Server Spawning Suspicious Processes
• Service Control Spawned via Script Interpreter
• Suspicious Cmd Execution via WMI
• Suspicious Command Prompt Network Connection
• Suspicious Execution from a Mounted Device
• Suspicious Execution from VS Code Extension
• Suspicious Explorer Child Process
• Suspicious JetBrains TeamCity Child Process
• Suspicious Microsoft HTML Application Child Process
• Suspicious MS Office Child Process
• Suspicious MS Outlook Child Process
• Suspicious React Server Child Process
• Suspicious ScreenConnect Client Child Process
• Suspicious Shell Execution via Velociraptor
• Suspicious SolarWinds Web Help Desk Java Module Load or Child Process
• Suspicious Windows Command Shell Arguments
• Suspicious Zoom Child Process
• System Information Discovery via Windows Command Shell
• System Shells via Services
• Web Shell Detection: Script Process Child of Common Web Processes
• Windows Server Update Service Spawning Suspicious Processes
• Windows System Information Discovery

Splunk 55 rules

• CMD Carry Out String Command Parameter
• CMD Echo Pipe - Escalation
• CMD execution with _c (PowerShell)
• CMD execution with _c (Sysmon)
• CMD execution with _c (Windows Event Log)
• Command Line .cmd Execution (Sysmon)
• Command Line .cmd Execution (Windows Event Log)
• Command-Line Interface Execution (PowerShell)
• Command-Line Interface Execution (Sysmon)
• Command-Line Interface Execution (Windows Event Log)
• Common Reconnaissance Commands (PowerShell)
• Common Reconnaissance Commands (Sysmon)
• Common Reconnaissance Commands (Windows Event Log)
• CrushFTP Authentication Bypass Exploitation
• Detect Prohibited Applications Spawning cmd exe
• Detect Use of cmd exe to Launch Script Interpreters
• Executable Create Script Process (PowerShell)
• Executable Create Script Process (Sysmon)
• Executable Create Script Process (Windows Event Log)
• Impacket atexec.py Execution (PowerShell)
• Impacket atexec.py Execution (Sysmon)
• Impacket atexec.py Execution (Windows Event Log)
• Impacket atexec.py Scheduled Task Creation (Windows Event Log)
• Impacket atexec.py Temp File Creation (Sysmon)
• Impacket atexec.py Temp File Creation (Windows Event Log)
• Meterpreter Reverse Shell (Windows Event Log)
• Microsoft Build Engine Suspicious Parent Process (Sysmon)
• Microsoft Build Engine Suspicious Parent Process (Windows Event Log)
• Output to File (PowerShell)
• Output to File (Windows Event Log)
• PowerShell Downgrade (PowerShell)
• PowerShell Downgrade (Sysmon)
• PowerShell Downgrade (Windows Event Log)
• Rare Process Execution (Sysmon)
• Rare Process Execution (Windows Event Log)
• Remote Admin Tools (EDR)
• Remote Admin Tools (PowerShell)
• Remote Admin Tools (Sysmon)
• Remote Admin Tools (Windows Event Log)
• Ryuk Wake on LAN Command
• SharpHound Enumeration (Windows Event Log)
• Suspicious Executable by Powershell (EDR)
• Suspicious Executable by Powershell (Sysmon)
• Suspicious Executable by Powershell (Windows Event Log)
• WebDAV LNK Execution (Sysmon)
• WebDAV LNK Execution (Windows Event Log)
• Windows Command Shell DCRat ForkBomb Payload
• Windows File Association Modification via Ftype
• Windows PowerShell FakeCAPTCHA Clipboard Execution
• Windows Powershell History File Deletion
• Windows PowerShell Invoke-Sqlcmd Execution
• Windows Shell Process from CrushFTP
• Windows SQLCMD Execution
• Windows Suspicious React or Next.js Child Process
• Windows TinyCC Shellcode Execution

Kusto 3 rules

• Exchange Worker Process Making Remote Call
• Execution attempts stateful anomaly on database
• Powershell Empire Cmdlets Executed in Command Line