CMD Shell Output Redirect
A Sigma rule for process creation on Windows, from SigmaHQ’s threat hunting rules, by frack113.
low 1 ATT&CK technique 1 program it names 5 everyday examples trip it
What it looks for
detection:
filter_optional_idm_extension:
CommandLine|contains:
- 'C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe'
- 'chrome-extension://'
- '\\.\pipe\chrome.nativeMessaging'
selection_cli:
CommandLine|contains: '>'
selection_cmd:
- OriginalFileName: 'Cmd.Exe'
- Image|endswith: '\cmd.exe'
condition: all of selection_* and not 1 of filter_optional_*
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by frack113, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
To send the output of assoc to the file assoc.txt, type on the page for assoc
assoc>assoc.txtIdentifyTo change the default directory on a drive that is different from the one you are on on the page for cd
cd [<drive>:[<directory>]]IdentifyYou can also redirect output of the dir command to a file by replacing prn with a file name. You can also type a path. For example, to direct dir output to the file dir.doc in the Records directory, type on the page for dir
dir > \records\dir.docIdentifyThe commands documented for cmd.exe, ftp.exe, unregmp2.exe, wscript.exe trip it too: each is on its program’s page, read by CmdID.