Suspicious Windows Command Shell Arguments

  1[metadata]
  2creation_date = "2024/09/06"
  3integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the execution of the Windows Command Shell process (cmd.exe) with suspicious argument values. This behavior
 11is often observed during malware installation.
 12"""
 13from = "now-9m"
 14index = [
 15    "logs-crowdstrike.fdr*",
 16    "logs-m365_defender.event-*",
 17    "logs-sentinel_one_cloud_funnel.*",
 18    "logs-system.security*",
 19    "logs-windows.forwarded*",
 20    "logs-windows.sysmon_operational-*",
 21    "winlogbeat-*",
 22    "endgame-*",
 23]
 24language = "eql"
 25license = "Elastic License v2"
 26name = "Suspicious Windows Command Shell Arguments"
 27risk_score = 73
 28rule_id = "d9ffc3d6-9de9-4b29-9395-5757d0695ecf"
 29severity = "high"
 30tags = [
 31    "Domain: Endpoint",
 32    "OS: Windows",
 33    "Use Case: Threat Detection",
 34    "Tactic: Execution",
 35    "Resources: Investigation Guide",
 36    "Data Source: Windows Security Event Logs",
 37    "Data Source: Sysmon",
 38    "Data Source: SentinelOne",
 39    "Data Source: Microsoft Defender XDR",
 40    "Data Source: Elastic Endgame",
 41    "Data Source: Crowdstrike",
 42    "Noise: Medium",
 43    "Performance: Normal",
 44    "Profile: Recommended",
 45    "Threat: Living off the Land",
 46    "Rule Type: Event Correlation (EQL)",
 47    "Platform: Windows",
 48]
 49timestamp_override = "event.ingested"
 50type = "eql"
 51
 52query = '''
 53process where host.os.type == "windows" and event.type == "start" and
 54  process.name : "cmd.exe" and
 55  (
 56    process.command_line : (
 57        "*).Run(*", "*GetObject*", "* curl*regsvr32*", "*echo*wscript*", "*echo*ZONE.identifier*",
 58        "*ActiveXObject*", "*dir /s /b *echo*", "*unescape(*",  "*findstr*TVNDRgAAAA*", "*findstr*passw*", "*start*\\\\*\\DavWWWRoot\\*",
 59        "* explorer*%CD%*", "*%cd%\\*.js*", "*attrib*%CD%*", "*/?cMD<*", "*/AutoIt3ExecuteScript*..*", "*&cls&cls&cls&cls&cls&*",
 60        "*&#*;&#*;&#*;&#*;*", "* &&s^eT*", "*& ChrW(*", "*&explorer /root*", "*start __ & __\\*", "*findstr /V /L *forfiles*",
 61        "*=wscri& set *", "*http*!COmpUternaME!*", "*start *.pdf * start /min cmd.exe /c *\\\\*", "*pip install*System.Net.WebClient*",
 62        "*Invoke-WebReques*Start-Process*", "*-command (Invoke-webrequest*", "*copy /b *\\\\* ping *-n*", "*echo*.ToCharArray*"
 63    ) or
 64
 65    (process.args : "echo" and process.parent.name : ("wscript.exe", "mshta.exe")) or
 66    
 67    process.args : ("1>?:\\*.vbs", "1>?:\\*.js") or
 68
 69    (process.args : "explorer.exe" and process.args : "type" and process.args : ">" and process.args : "start") or
 70
 71    (
 72      process.parent.name : "explorer.exe" and
 73      process.command_line : (
 74        "*&&S^eT *",
 75        "*&& set *&& set *&& set *&& set *&& set *&& call*",
 76        "**\\u00??\\u00??\\u00??\\u00??\\u00??\\u00??\\u00??\\u00??*"
 77      )
 78    ) or
 79
 80    (process.parent.name : "explorer.exe" and process.args : "copy" and process.args : "&&" and process.args : "\\\\*@*\\*")
 81  ) and
 82
 83  /* false positives */
 84  not (process.args : "%TEMP%\\Spiceworks\\*" and process.parent.name : "wmiprvse.exe") and
 85  not ?process.parent.executable : (
 86        "?:\\Perl64\\bin\\perl.exe",
 87        "?:\\Program Files\\nodejs\\node.exe",
 88        "?:\\Program Files\\HP\\RS\\pgsql\\bin\\pg_dumpall.exe",
 89        "?:\\Program Files (x86)\\PRTG Network Monitor\\64 bit\\PRTG Server.exe",
 90        "?:\\Program Files (x86)\\Spiceworks\\bin\\spiceworks-finder.exe",
 91        "?:\\Program Files (x86)\\Zuercher Suite\\production\\leds\\leds.exe",
 92        "?:\\Program Files\\Tripwire\\Agent\\Plugins\\twexec\\twexec.exe",
 93        "D:\\Agents\\?\\_work\\_tasks\\*\\SonarScanner.MSBuild.exe",
 94        "?:\\Program Files\\Microsoft VS Code\\Code.exe",
 95        "?:\\programmiweb\\NetBeans-*\\netbeans\\bin\\netbeans64.exe",
 96        "?:\\Program Files (x86)\\Public Safety Suite Professional\\production\\leds\\leds.exe",
 97        "?:\\Program Files (x86)\\Tier2Tickets\\button_gui.exe",
 98        "?:\\Program Files\\NetBeans-*\\netbeans\\bin\\netbeans*.exe",
 99        "?:\\Program Files (x86)\\Public Safety Suite Professional\\production\\leds\\leds.exe",
100        "?:\\Program Files (x86)\\Tier2Tickets\\button_gui.exe",
101        "?:\\Program Files (x86)\\Helpdesk Button\\button_gui.exe",
102        "?:\\VTSPortable\\VTS\\jre\\bin\\javaw.exe",
103        "?:\\Program Files\\Bot Framework Composer\\Bot Framework Composer.exe",
104        "?:\\Program Files\\KMSYS Worldwide\\eQuate\\*\\SessionMgr.exe",
105        "?:\\Program Files (x86)\\Craneware\\Pricing Analyzer\\Craneware.Pricing.Shell.exe",
106        "?:\\Program Files (x86)\\jumpcloud-agent-app\\jumpcloud-agent-app.exe",
107        "?:\\Program Files\\PostgreSQL\\*\\bin\\pg_dumpall.exe",
108        "?:\\Program Files (x86)\\Vim\\vim*\\vimrun.exe") and
109  not (
110        /* Crowdstrike doesn't populate process.parent.executable */
111        data_stream.dataset == "crowdstrike.fdr" and
112        process.parent.name : (
113          "perl.exe", "node.exe", "pg_dumpall.exe", "PRTG Server.exe", "spiceworks-finder.exe", "leds.exe", "twexec.exe",
114          "SonarScanner.MSBuild.exe", "Code.exe", "netbeans64.exe", "javaw.exe", "Bot Framework Composer.exe", "SessionMgr.exe",
115          "Craneware.Pricing.Shell.exe", "jumpcloud-agent-app.exe", "vimrun.exe"
116        )
117      ) and
118  not (process.args :  "?:\\Program Files\\Citrix\\Secure Access Client\\nsauto.exe" and process.parent.name : "userinit.exe") and
119  not process.args : (
120        "?:\\Program Files (x86)\\PCMatic\\PCPitstopScheduleService.exe",
121        "?:\\Program Files (x86)\\AllesTechnologyAgent\\*",
122        "https://auth.axis.com/oauth2/oauth-authorize*"
123  ) and
124  not process.command_line : (
125    "\"cmd\" /c %NETBEANS_MAVEN_COMMAND_LINE%",
126    "?:\\Windows\\system32\\cmd.exe /q /d /s /c \"npm.cmd ^\"install^\" ^\"--no-bin-links^\" ^\"--production^\"\""
127  ) and
128  not (process.name : "cmd.exe" and process.args : "%TEMP%\\Spiceworks\\*" and process.args : "http*/dataloader/persist_netstat_data") and
129  not (process.args == "echo" and process.args == "GEQ" and process.args == "1073741824")
130'''
131
132note = """## Triage and analysis
133
134### Investigating Suspicious Windows Command Shell Arguments
135
136#### Possible investigation steps
137
138- What abuse path and launch context does the alerting "cmd.exe" show?
139  - Focus: `process.command_line`, `process.args`, `process.executable`, `process.parent.executable`, and `process.parent.command_line`; classify reconstruction, remote retrieval, WebDAV or UNC execution, obfuscated environment setup, or handoff to "regsvr32.exe", "wscript.exe", "mshta.exe", PowerShell, or AutoIt.
140  - Implication: escalate when the command reconstructs scripts, pulls remote content, starts from a remote share, chains to proxy execution, runs from a non-native path, or has a parent conflicting with command purpose; lower suspicion only when parent-command, user-host, child, artifact, and destination evidence form one consistent current activity. Identity or recurrence alone does not clear suspicious arguments.
141
142- Did the same "cmd.exe" instance launch a second stage?
143  - Focus: child starts where `host.id` and `process.parent.entity_id` map to `process.entity_id`; review child `process.executable` and `process.command_line`. $investigate_2
144  - Hint: if `process.entity_id` is absent, use `host.id` plus `process.pid` in a tight alert-time window.
145  - Implication: escalate when the shell launches PowerShell, "regsvr32.exe", "wscript.exe", "mshta.exe", archive tools, script files, or newly staged payloads; lower suspicion when no child follows or stays inside the parent directory or command-named output path.
146
147- If endpoint file telemetry is available, did the shell reconstruct or stage executable content?
148  - Focus: file activity tied to `process.entity_id` or, if needed, `host.id` plus `process.pid`, checking `file.path`, `file.Ext.original.path`, `file.Ext.header_bytes`, and `file.Ext.windows.zone_identifier`. $investigate_4
149  - Implication: escalate when the shell writes scriptable files, rebuilds archive or PE content, renames staged payloads, or leaves internet-marked content in temp, public, or user-writable paths; lower suspicion when paths stay under the parent directory or command-named output path and no written content later executes. Missing file telemetry is unresolved, not benign.
150
151- If endpoint network telemetry is available, did the shell retrieve content or execute from WebDAV or UNC infrastructure?
152  - Focus: process-scoped DNS and connections for `host.id` and `process.entity_id`; compare DNS `dns.question.name` or `dns.resolved_ip` and connection `destination.ip` or `destination.port` with UNC, "DavWWWRoot", or URL fragments in `process.command_line`. $investigate_3
153  - Hint: if `dns.resolved_ip` is present, correlate it to `destination.ip` on the same host and process before judging the destination.
154  - Implication: escalate when the shell reaches rare public hosts, unexpected WebDAV endpoints, or shares unrelated to the parent; lower suspicion when DNS and connections match the share, URL, or host pattern visible in the command and parent. Missing network telemetry is unresolved, not benign.
155
156- If local findings remain suspicious or unresolved, does the pattern recur on the same host or user?
157  - Focus: recent alerts for the same `host.id`, emphasizing execution, delivery, persistence, or proxy-execution detections that reuse the same command-shell pattern. $investigate_0
158  - Hint: if the host is shared or quiet, compare recent alerts for the same `user.id` to test whether the user carries the pattern to other systems. $investigate_1
159  - Implication: broaden scope when the same host or user also shows delivery, shell, or persistence alerts; keep local when related alerts are clean and telemetry binds one parent-command, child, artifact, destination, and user-host tuple.
160
161- What disposition does the parent-command, child, artifact, destination, and user-host tuple support?
162  - Escalate for staged execution, remote retrieval, script reconstruction, proxy execution, or broader compromise; close only when alert-local command, parent, child, artifact, destination, user-host, and related-alert evidence bind one exact benign tuple with no contradictions. Preserve evidence and escalate on conflicts or incomplete visibility.
163
164### False positive analysis
165
166- Packaging, build, installer, or developer activity can use "cmd.exe" to reconstruct files, call package managers, or hand off to helper utilities. Confirm `process.parent.executable`, `process.parent.command_line`, `process.command_line`, `user.id`, and `host.id` align with the same current parent path, helper command, package cache, build output, or database-export output, and that recovered child, file, or destination evidence does not conflict. Build records or change tickets are corroboration only.
167- Remote-support or software-distribution activity can reference UNC paths or "DavWWWRoot". When network or file telemetry exists, confirm `process.command_line`, `process.parent.executable`, `host.id`, and any recovered `dns.question.name`, `destination.ip`, or `file.path` stay inside one current distribution share, vendor endpoint, support-client cache, or deployment path and no unexpected child appears. Missing file or network telemetry is unresolved, not benign. Support records or inventories are corroboration only.
168- Before creating an exception, validate that the same `process.parent.executable`, `process.command_line`, `user.id`, `host.id`, and recovered artifact or destination anchors recur across prior alerts from this rule. Avoid exceptions on "cmd.exe" alone, one argument token, one destination, or parent name.
169
170### Response and remediation
171
172- If confirmed benign, reverse temporary containment and document the parent command, alerting command, user-host scope, and recovered artifact or destination evidence. Create an exception only after the same tuple is stable across prior alerts from this rule.
173- If suspicious but unconfirmed, preserve the alert, Timeline records, full command lines, process tree, recovered child details, staged files, and DNS or connection evidence before destructive action. Apply reversible containment first, such as temporary destination restrictions or heightened monitoring on `host.id` and `user.id`; isolate only when follow-on execution, staged payloads, or remote retrieval justifies disruption.
174- If confirmed malicious, isolate the host when identity, lineage, artifact, or destination evidence establishes unauthorized execution, then block confirmed malicious domains, destinations, or hashes. Record malicious shell and child identifiers before termination, scope related hosts and users before artifact removal, then remove only the scripts, archives, rebuilt payloads, persistence artifacts, or launcher components identified during the investigation.
175- Post-incident hardening: retain process, file, and network telemetry. If browser, explorer, script-host, or AutoIt launch paths were involved, review controls for user-driven shell launches; if WebDAV, UNC, or URL retrieval was involved, review remote-share and WebDAV execution controls. Note adjacent "mshta.exe", "wscript.exe", "regsvr32.exe", PowerShell, AutoIt, and explorer-driven clickfix-style variants for future triage.
176"""
177
178setup = """## Setup
179
180This rule requires telemetry from one of the configured source integrations to be enabled and ingested.
181
182### Supported data sources
183
184This rule can use the following data sources. For setup instructions, refer to the links below:
185
186- [CrowdStrike](https://ela.st/crowdstrike-integration)
187- [Microsoft Defender XDR](https://ela.st/m365-defender)
188- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
189- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
190- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
191"""
192
193[rule.investigation_fields]
194field_names = [
195    "@timestamp",
196    "host.id",
197    "user.id",
198    "process.entity_id",
199    "process.pid",
200    "process.executable",
201    "process.command_line",
202    "process.args",
203    "process.parent.name",
204    "process.parent.executable",
205    "process.parent.command_line",
206    "process.parent.args",
207]
208
209[transform]
210
211[[transform.investigate]]
212label = "Alerts associated with the host"
213description = ""
214providers = [
215  [
216    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
217    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
218  ]
219]
220relativeFrom = "now-48h/h"
221relativeTo = "now"
222
223[[transform.investigate]]
224label = "Alerts associated with the user"
225description = ""
226providers = [
227  [
228    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
229    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
230  ]
231]
232relativeFrom = "now-48h/h"
233relativeTo = "now"
234
235[[transform.investigate]]
236label = "Child process starts from the same cmd.exe instance"
237description = ""
238providers = [
239  [
240    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
241    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
242    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
243  ],
244  [
245    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
246    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
247    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
248  ]
249]
250relativeFrom = "now-1h"
251relativeTo = "now"
252
253[[transform.investigate]]
254label = "Network activity for the alerting cmd.exe instance"
255description = ""
256providers = [
257  [
258    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
259    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
260    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
261  ],
262  [
263    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
264    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
265    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
266  ]
267]
268relativeFrom = "now-1h"
269relativeTo = "now"
270
271[[transform.investigate]]
272label = "File activity for the alerting cmd.exe instance"
273description = ""
274providers = [
275  [
276    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
277    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
278    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
279  ],
280  [
281    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
282    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
283    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
284  ]
285]
286relativeFrom = "now-1h"
287relativeTo = "now"
288
289[[rule.threat]]
290framework = "MITRE ATT&CK"
291
292[[rule.threat.technique]]
293id = "T1059"
294name = "Command and Scripting Interpreter"
295reference = "https://attack.mitre.org/techniques/T1059/"
296
297[[rule.threat.technique.subtechnique]]
298id = "T1059.003"
299name = "Windows Command Shell"
300reference = "https://attack.mitre.org/techniques/T1059/003/"
301
302[rule.threat.tactic]
303id = "TA0002"
304name = "Execution"
305reference = "https://attack.mitre.org/tactics/TA0002/"
306
307[[rule.threat]]
308framework = "MITRE ATT&CK"
309
310[[rule.threat.technique]]
311id = "T1105"
312name = "Ingress Tool Transfer"
313reference = "https://attack.mitre.org/techniques/T1105/"
314
315[rule.threat.tactic]
316id = "TA0011"
317name = "Command and Control"
318reference = "https://attack.mitre.org/tactics/TA0011/"
319
320[[rule.threat]]
321framework = "MITRE ATT&CK"
322
323[[rule.threat.technique]]
324id = "T1027"
325name = "Obfuscated Files or Information"
326reference = "https://attack.mitre.org/techniques/T1027/"
327
328[[rule.threat.technique]]
329id = "T1218"
330name = "System Binary Proxy Execution"
331reference = "https://attack.mitre.org/techniques/T1218/"
332
333[[rule.threat.technique.subtechnique]]
334id = "T1218.005"
335name = "Mshta"
336reference = "https://attack.mitre.org/techniques/T1218/005/"
337
338[[rule.threat.technique.subtechnique]]
339id = "T1218.010"
340name = "Regsvr32"
341reference = "https://attack.mitre.org/techniques/T1218/010/"
342
343[rule.threat.tactic]
344id = "TA0005"
345name = "Defense Evasion"
346reference = "https://attack.mitre.org/tactics/TA0005/"