Possible Commandline Obfuscation Via Escape Characters (via process_creation)

title: Possible Commandline Obfuscation Via Escape Characters (via process_creation)
id: 356fa6ed-0f36-59ab-bf1d-0f0d4deb1645
status: stable
description: This rule detects potential commandline obfuscation using known escape characters
references:
    - https://attack.mitre.org/techniques/T1140/
    - https://twitter.com/vysecurity/status/885545634958385153
    - https://twitter.com/Hexacorn/status/885553465417756673
    - https://twitter.com/Hexacorn/status/885570278637678592
    - https://www.mandiant.com/resources/blog/obfuscation-wild-targeted-attackers-lead-way-evasion-techniques
    - https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/
author: Huntrule Team
date: 2026-05-31
tags:
    - attack.stealth
    - attack.t1140
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'h^t^t^p'
            - 'h"t"t"p'
    condition: selection
falsepositives:
    - Unknown
level: medium