Detection rules › Splunk
Command Line .cmd Execution (Sysmon)
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. This use case detects the use of cmd.exe /c to execute .cmd files. This technique has been used by BazaLoader to execute malware masquerading as a PDF inside a .zip file
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.003 Command and Scripting Interpreter: Windows Command Shell |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '15032.22715'
title: Command Line .cmd Execution
description: 'Adversaries may attempt to manipulate features of their artifacts to
make them appear legitimate or benign to users and/or security tools. Masquerading
occurs when the name or location of an object, legitimate or malicious, is manipulated
or abused for the sake of evading defenses and observation. This may include manipulating
file metadata, tricking users into misidentifying the file type, and giving legitimate
task or service names. This use case detects the use of cmd.exe /c to execute .cmd
files. This technique has been used by BazaLoader to execute malware masquerading
as a PDF inside a .zip file. -- Threat Actor Association: Andariel, APT28, APT40,
APT-K-47/Mysterious Elephant, GoldenJackal, Kimsuky, Rhysida, Sandworm Team, Volt
Typhoon -- Atomics T1036 Test #2 Atomics T1059.003 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"cmd.exe" "/c" ".cmd" | regex process="(?i)cmd.*\s+/c\s+.*?\w+\.cmd" | table _time,
host, user, process, process_*, parent_process, parent_process_*, user | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.003
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md#atomic-test-2---malware-masquerading-and-execution-from-zip-file
- https://twitter.com/ffforward/status/1481672378639912960
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "cmd.exe" "/c" ".cmd"
Stage 2: regex
| regex process="(?i)cmd.*\s+/c\s+.*?\w+\.cmd"
Stage 3: table
| table _time, host, user, process, process_*, parent_process, parent_process_*, user
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "cmd.exe" |
| 1 | "/c" |
| 1 | ".cmd" |