Windows: cmd.exe Launched by AnyViewer Agent (AVCore.exe)
Alerts when AnyViewer’s AVCore.exe launches cmd.exe with -d in a remote management context.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2024-08-03
- Updated
- 2026-07-31
What it detects
This rule flags process creation where cmd.exe is spawned with a parent process of AVCore.exe associated with AnyViewer remote support. This matters because remote management tooling can be abused to execute commands on a target, providing attackers a way to run arbitrary shell activity. The detection relies on Windows process creation telemetry, matching the cmd.exe image path and the AVCore.exe parent process command-line context.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
anyviewer-rmm-remote-session-executes-cmd-exe-via-avcore-exe-bc533330
title: "Windows: cmd.exe Launched by AnyViewer Agent (AVCore.exe)"
id: d697f8a6-7fa8-4ad2-bcf9-a418f42a08db
status: test
description: This rule flags process creation where cmd.exe is spawned with a parent process of AVCore.exe associated with AnyViewer remote support. This matters because remote management tooling can be abused to execute commands on a target, providing attackers a way to run arbitrary shell activity. The detection relies on Windows process creation telemetry, matching the cmd.exe image path and the AVCore.exe parent process command-line context.
references:
- https://www.anyviewer.com/help/remote-technical-support.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_anyviewer_shell_exec.yml
author: "@kostastsale, Huntrule Team"
date: 2024-08-03
tags:
- attack.execution
- attack.persistence
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \AVCore.exe
ParentCommandLine|contains: AVCore.exe" -d
Image|endswith: \cmd.exe
condition: selection
falsepositives:
- Legitimate use for admin activity.
level: medium
license: DRL-1.1
related:
- id: bc533330-fc29-44c0-b245-7dc6e5939c87
type: derived