sigmahighHunting

Cmd.EXE Missing Space Characters Execution Anomaly

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

MITRE ATT&CK

T1059.001

execution

Detection Query

selection1:
  CommandLine|contains:
    - cmd.exe/c
    - \cmd/c
    - '"cmd/c'
    - cmd.exe/k
    - \cmd/k
    - '"cmd/k'
    - cmd.exe/r
    - \cmd/r
    - '"cmd/r'
selection2:
  CommandLine|contains:
    - /cwhoami
    - /cpowershell
    - /cschtasks
    - /cbitsadmin
    - /ccertutil
    - /kwhoami
    - /kpowershell
    - /kschtasks
    - /kbitsadmin
    - /kcertutil
selection3:
  CommandLine|contains:
    - cmd.exe /c
    - cmd /c
    - cmd.exe /k
    - cmd /k
    - cmd.exe /r
    - cmd /r
filter_generic:
  CommandLine|contains:
    - "cmd.exe /c "
    - "cmd /c "
    - "cmd.exe /k "
    - "cmd /k "
    - "cmd.exe /r "
    - "cmd /r "
filter_fp:
  - CommandLine|contains: AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules
  - CommandLine|endswith: cmd.exe/c .
  - CommandLine: cmd.exe /c
condition: 1 of selection* and not 1 of filter_*

Author

Florian Roth (Nextron Systems)

Created

2022-08-23

Data Sources

windowsProcess Creation Events

Platforms

windows

References

Tags

attack.executionattack.t1059.001

Raw Content

title: Cmd.EXE Missing Space Characters Execution Anomaly
id: a16980c2-0c56-4de0-9a79-17971979efdd
status: test
description: |
    Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.
    This could be a sign of obfuscation of a fat finger problem (typo by the developer).
references:
    - https://twitter.com/cyb3rops/status/1562072617552678912
    - https://ss64.com/nt/cmd.html
author: Florian Roth (Nextron Systems)
date: 2022-08-23
modified: 2023-03-06
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection1:  # missing space before the /c
        CommandLine|contains:
            - 'cmd.exe/c'
            - '\cmd/c'  # just cmd/c would be prone to false positives
            - '"cmd/c'
            - 'cmd.exe/k'
            - '\cmd/k'  # just cmd/k would be prone to false positives
            - '"cmd/k'
            - 'cmd.exe/r'
            - '\cmd/r'  # just cmd/r would be prone to false positives
            - '"cmd/r'
    selection2: # special cases verified via Virustotal Enterprise search
        CommandLine|contains:
            - '/cwhoami'
            - '/cpowershell'
            - '/cschtasks'
            - '/cbitsadmin'
            - '/ccertutil'
            - '/kwhoami'
            - '/kpowershell'
            - '/kschtasks'
            - '/kbitsadmin'
            - '/kcertutil'
    selection3:  # missing space after the /c
        CommandLine|contains:
            - 'cmd.exe /c'
            - 'cmd /c'
            - 'cmd.exe /k'
            - 'cmd /k'
            - 'cmd.exe /r'
            - 'cmd /r'
    filter_generic:
        CommandLine|contains:
            - 'cmd.exe /c '
            - 'cmd /c '
            - 'cmd.exe /k '
            - 'cmd /k '
            - 'cmd.exe /r '
            - 'cmd /r '
    filter_fp:
        - CommandLine|contains: 'AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules'
        - CommandLine|endswith: 'cmd.exe/c .'
        - CommandLine: 'cmd.exe /c'
    condition: 1 of selection* and not 1 of filter_*
falsepositives:
    - Unknown
level: high