Console CodePage Lookup Via CHCP

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: _pete_0, TheDFIRReport
Source: github.com/SigmaHQ/sigma

Detects use of chcp to look up the system locale value as part of host discovery

Known false positives

During Anaconda update the 'conda.exe' process will eventually execution the 'chcp' command.
Discord was seen using chcp to look up code pages

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1614.001` System Location Discovery: System Language Discovery

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Console CodePage Lookup Via CHCP
id: 7090adee-82e2-4269-bd59-80691e7c6338
status: test
description: Detects use of chcp to look up the system locale value as part of host discovery
references:
    - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
author: _pete_0, TheDFIRReport
date: 2022-02-21
modified: 2024-03-05
tags:
    - attack.discovery
    - attack.t1614.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|contains|windash:
            - ' -c '
            - ' -r '
            - ' -k '
        Image|endswith: '\chcp.com'
        CommandLine|endswith:
            - 'chcp'
            - 'chcp '
            - 'chcp  '
    condition: selection
falsepositives:
    - During Anaconda update the 'conda.exe' process will eventually execution the 'chcp' command.
    - Discord was seen using chcp to look up code pages
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup/info.yml

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ParentImage|endswith: '\cmd.exe'
    ParentCommandLine|contains|windash:
        - ' -c '
        - ' -r '
        - ' -k '
    Image|endswith: '\chcp.com'
    CommandLine|endswith:
        - 'chcp'
        - 'chcp '
        - 'chcp  '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`chcp` `chcp` `chcp`	`field:"CommandLine" kind:ends_with`
`Image`	ends_with	`\chcp.com` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\chcp.com"`
`ParentCommandLine`	match	`-c` transforms: `windash` `-k` transforms: `windash` `-r` transforms: `windash`	`field:"ParentCommandLine" kind:match`
`ParentImage`	ends_with	`\cmd.exe` corpus 20 (sigma 20)	`field:"ParentImage" kind:ends_with value:"\cmd.exe"`

Console CodePage Lookup Via CHCP

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`