detection.wiki

Detection rules › Sigma

CMD Shell Output Redirect

Status
test
Severity
low
Log source
product windows, category process_creation
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects the use of the redirection character ">" to redirect information on the command line. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1082 System Information Discovery

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: CMD Shell Output Redirect
id: 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
related:
    - id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892
      type: similar
status: test
description: |
    Detects the use of the redirection character ">" to redirect information on the command line.
    This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
references:
    - https://ss64.com/nt/syntax-redirection.html
author: frack113
date: 2022-01-22
modified: 2024-03-19
tags:
    - attack.discovery
    - attack.t1082
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd:
        - OriginalFileName: 'Cmd.Exe'
        - Image|endswith: '\cmd.exe'
    selection_cli:
        CommandLine|contains: '>'
    filter_optional_idm_extension:
        CommandLine|contains:
            - 'C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe'
            - 'chrome-extension://'
            - '\\.\pipe\chrome.nativeMessaging'
    condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
    - Internet Download Manager extensions use named pipes and redirection via CLI. Filter it out if you use it in your environment
level: low

Stages and Predicates

Stage 0: condition

all of selection_* and not 1 of filter_optional_*

Stage 1: selection_cmd

selection_cmd:
    - OriginalFileName: 'Cmd.Exe'
    - Image|endswith: '\cmd.exe'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains: '>'

Stage 3: not filter_optional_idm_extension

filter_optional_idm_extension:
    CommandLine|contains:
        - 'C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe'
        - 'chrome-extension://'
        - '\\.\pipe\chrome.nativeMessaging'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLinematchC:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe
CommandLinematch\\.\pipe\chrome.nativeMessaging
CommandLinematchchrome-extension://

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • > corpus 6 (sigma 6)
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
OriginalFileNameeq
  • Cmd.Exe corpus 65 (sigma 43, splunk 17, elastic 5)