Obfuscated Commands - Command Shell

SIGMA detection rule by RedCanary, Sigma formatting by Micah Babinski · GPL-3.0

Detecting obfuscation in the command shell is relatively straightforward, but there are a lot of variations to consider when you’re developing detection coverage. Of course, the process you’re looking for will always be cmd.exe, but the corresponding command line can contain a variety of suspicious characters. The trick is finding the thresholds where the inclusion of obfuscation characters go from normal to anomalous (but benign) to suspicious enough to warrant alerting. The following pseudo-detection logic offers a good starting point for developing detection coverage for obfuscation in the command line. Part of the RedCanary 2024 Threat Detection Report.

title: Obfuscated Commands - Command Shell
id: b58b6c4b-0f79-407e-b2ab-76de16a6cd79
status: experimental
description: |
    Detecting obfuscation in the command shell is relatively straightforward, but 
    there are a lot of variations to consider when you’re developing detection 
    coverage. Of course, the process you’re looking for will always be cmd.exe, 
    but the corresponding command line can contain a variety of suspicious characters. 
    The trick is finding the thresholds where the inclusion of obfuscation characters 
    go from normal to anomalous (but benign) to suspicious enough to warrant alerting. 
    The following pseudo-detection logic offers a good starting point for developing 
    detection coverage for obfuscation in the command line. Part of the RedCanary 2024 
    Threat Detection Report.
references:
    - https://redcanary.com/threat-detection-report/techniques/windows-command-shell/
author: RedCanary, Sigma formatting by Micah Babinski
date: 2024/03/21
tags:
    - attack.execution
    - attack.t1059
    - attack.t1059.003
    - attack.defense_evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\cmd.exe'
        # regex below looks for eight or more total instances of the suspicious characters
        CommandLine|re: '^([^^=%![(; ]*[\^=%![(; ]){8,}[^^=%![(; ]*$'
    condition: selection
falsepositives:
    - Unknown
level: low

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e66aca35-9006-46c7-8629-b5bd4afa5766

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion