Detection rules › Splunk
Discovery using CHCP (Windows Event Log)
CHCP ("Change Code Page" ) is a legitimate Windows command-line utility used to display or set the active console's code page. When run without parameters, chcp displays the number of the active console code page, providing information about the environment's locale and language. Threat actors have used been observed using chcp during discovery activities during intrusions involving IcedID and Conti ransomware. This use case detects chcp executions with no command line parameters and a parent process of cmd or PowerShell executed by a non-system account
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1614.001 System Location Discovery: System Language Discovery |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '27700.50349'
title: Discovery using CHCP
description: 'CHCP ("Change Code Page" ) is a legitimate Windows command-line utility
used to display or set the active console''s code page. When run without parameters,
chcp displays the number of the active console code page, providing information
about the environment''s locale and language. Threat actors have used been observed
using chcp during discovery activities during intrusions involving IcedID and Conti
ransomware. This use case detects chcp executions with no command line parameters
and a parent process of cmd or PowerShell executed by a non-system account. -- Threat
Actor Association: APT28 (aka. Fancy Bear, Forest Blizzard, Strontium, Tsar Team)
-- Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) ("chcp" OR "chcp.com") ("pwsh.exe" OR "powershell.exe"
OR "cmd.exe") | where match(process_name, "(?i)chcp\.com") and match(process, "(?i)chcp\s+?$")
and match(parent_process_name, "(?i)(powershell|pwsh|cmd)\.exe") and not match(user,
"\$$") | table _time, host, user, process, process_*, parent_process_name, parent_process_*
| bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:system location discovery:system language discovery
technique_id:
- T1614.001
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) ("chcp" OR "chcp.com") ("pwsh.exe" OR "powershell.exe" OR "cmd.exe")
Stage 2: where
| where match(process_name, "(?i)chcp\.com") and match(process, "(?i)chcp\s+?$") and match(parent_process_name, "(?i)(powershell|pwsh|cmd)\.exe") and not match(user, "\$$")
Stage 3: table
| table _time, host, user, process, process_*, parent_process_name, parent_process_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
user | match | "\$$" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
parent_process_name | match |
|
process | match |
|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | "chcp" |
| 1 | "chcp.com" |
| 1 | "pwsh.exe" |
| 1 | "powershell.exe" |
| 1 | "cmd.exe" |