Potential Command Line Path Traversal Evasion Attempt

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Christian Burkard (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline

Known false positives

Google Drive
Citrix

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036` Masquerading

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potential Command Line Path Traversal Evasion Attempt
id: 1327381e-6ab0-4f38-b583-4c1b8346a56b
status: test
description: Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline
references:
    - https://twitter.com/hexacorn/status/1448037865435320323
    - https://twitter.com/Gal_B1t/status/1062971006078345217
author: Christian Burkard (Nextron Systems)
date: 2021-10-26
modified: 2023-03-29
tags:
    - attack.stealth
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection_1:
        Image|contains: '\Windows\'
        CommandLine|contains:
            - '\..\Windows\'
            - '\..\System32\'
            - '\..\..\'
    selection_2:
        CommandLine|contains: '.exe\..\'
    filter_optional_google_drive:
        CommandLine|contains: '\Google\Drive\googledrivesync.exe\..\'
    filter_optional_citrix:
        CommandLine|contains: '\Citrix\Virtual Smart Card\Citrix.Authentication.VirtualSmartcard.Launcher.exe\..\'
    condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
    - Google Drive
    - Citrix
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_* and not 1 of filter_optional_*

Stage 1: `selection_1`

selection_1:
    Image|contains: '\Windows\'
    CommandLine|contains:
        - '\..\Windows\'
        - '\..\System32\'
        - '\..\..\'

Stage 2: `selection_2`

selection_2:
    CommandLine|contains: '.exe\..\'

Stage 3: `not filter_optional_*`

filter_optional_google_drive:
    CommandLine|contains: '\Google\Drive\googledrivesync.exe\..\'
filter_optional_citrix:
    CommandLine|contains: '\Citrix\Virtual Smart Card\Citrix.Authentication.VirtualSmartcard.Launcher.exe\..\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`\Citrix\Virtual Smart Card\Citrix.Authentication.VirtualSmartcard.Launcher.exe\..\`	`excludes:CommandLine` `field:"CommandLine" value:"\Citrix\Virtual Smart Card\Citrix.Authentication.VirtualSmartcard.Launcher.exe\..\"`
`CommandLine`	match	`\Google\Drive\googledrivesync.exe\..\`	`excludes:CommandLine` `field:"CommandLine" value:"\Google\Drive\googledrivesync.exe\..\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`.exe\..\` `\..\..\` `\..\System32\` `\..\Windows\`	`field:"CommandLine" kind:match`
`Image`	match	`\Windows\`	`field:"Image" kind:match value:"\Windows\"`

Potential Command Line Path Traversal Evasion Attempt

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_1

Stage 2: selection_2

Stage 3: not filter_optional_*

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection_1`

Stage 2: `selection_2`

Stage 3: `not filter_optional_*`