heroui logo

Cmd.EXE Missing Space Characters Execution Anomaly

Sigma Rules

View Source
Summary
The 'Cmd.EXE Missing Space Characters Execution Anomaly' rule is designed to detect potentially suspicious command line executions involving cmd.exe on Windows systems. Specifically, the rule targets instances where command lines are missing a space before or after the '/c' flag. This anomaly may indicate obfuscation techniques or mistakes typically referred to as 'fat finger' problems by developers, which could indicate attempts at evasion or misconfigurations. The detection utilizes several selection patterns to identify these anomalies in the command line, including checking for specific known commands that would typically use cmd.exe. It also implements filters to exclude known false positives, ensuring that the alerts raised are more accurately related to actual suspicious activity.
Categories
  • Windows
  • Endpoint
Data Sources
  • Process
Created: 2022-08-23