huntrule

Malicious Netcat Reverse Shell via Masqueraded StartMenuExperienceHost

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-07
Updated
2026-10-07
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a process named StartMenuExperienceHost.exe launching with netcat command-execution flags that pipe cmd.exe to a remote host, the reverse-shell mechanism deployed by the miner campaign abusing the Wazuh SIEM agent. The legitimate StartMenuExperienceHost never uses netcat -e style arguments, so this pattern reveals a masqueraded backdoor.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Suspicious Java Runtime Execution from LocalAppData Staging Folder
Suspicious Head Mare srvhost.exe Masquerading as System Service Host
Suspicious Masqueraded Exfiltration Utility AuditSvc Execution (via process_creation)
Malicious Text4Shell Apache Commons Text Interpolation Payload in HTTP Request
Malicious SolarWinds BusinessLayerHost Spawning Command Interpreter
Suspicious WerFault Masquerade Executing From Non-System Path Linked to Turla Snake
Suspicious MsMpEng Execution from Non-Standard Directory
Suspicious printfilterpipelinesvc.exe Executed from Non-System Path (via process_creation)
Malicious Scheduled Task Running svchost32 Proxy from Windows Temp
Malicious Netcat Reverse Shell via Masqueraded StartMenuExperienceHost
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.