CMD Shell Output Redirect

Status: test
Severity: low
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects the use of the redirection character ">" to redirect information on the command line. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.

Known false positives

Internet Download Manager extensions use named pipes and redirection via CLI. Filter it out if you use it in your environment

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1082` System Information Discovery

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: CMD Shell Output Redirect
id: 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
related:
    - id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892
      type: similar
status: test
description: |
    Detects the use of the redirection character ">" to redirect information on the command line.
    This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
references:
    - https://ss64.com/nt/syntax-redirection.html
author: frack113
date: 2022-01-22
modified: 2024-03-19
tags:
    - attack.discovery
    - attack.t1082
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd:
        - OriginalFileName: 'Cmd.Exe'
        - Image|endswith: '\cmd.exe'
    selection_cli:
        CommandLine|contains: '>'
    filter_optional_idm_extension:
        CommandLine|contains:
            - 'C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe'
            - 'chrome-extension://'
            - '\\.\pipe\chrome.nativeMessaging'
    condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
    - Internet Download Manager extensions use named pipes and redirection via CLI. Filter it out if you use it in your environment
level: low

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_optional_*

Stage 1: `selection_cmd`

selection_cmd:
    - OriginalFileName: 'Cmd.Exe'
    - Image|endswith: '\cmd.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: '>'

Stage 3: `not filter_optional_idm_extension`

filter_optional_idm_extension:
    CommandLine|contains:
        - 'C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe'
        - 'chrome-extension://'
        - '\\.\pipe\chrome.nativeMessaging'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe`	`excludes:CommandLine` `field:"CommandLine" value:"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe"`
`CommandLine`	match	`\\.\pipe\chrome.nativeMessaging`	`excludes:CommandLine` `field:"CommandLine" value:"\\.\pipe\chrome.nativeMessaging"`
`CommandLine`	match	`chrome-extension://`	`excludes:CommandLine` `field:"CommandLine" value:"chrome-extension://"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`>` corpus 6 (sigma 6)	`field:"CommandLine" kind:match value:">"`
`Image`	ends_with	`\cmd.exe` corpus 130 (sigma 130)	`field:"Image" kind:ends_with value:"\cmd.exe"`
`OriginalFileName`	eq	`Cmd.Exe` corpus 81 (sigma 43, elastic 21, splunk 17)	`field:"OriginalFileName" kind:eq value:"Cmd.Exe"`