Possible Download/Upload Behavior Via Type Command (via process_creation)

title: Possible Download/Upload Behavior Via Type Command (via process_creation)
id: d21ca03a-6116-5bd6-a094-9f37b961207a
status: stable
description: This rule detects use of the "type" command to download/upload data from WebDAV server
references:
    - https://attack.mitre.org/techniques/T1105/
    - https://mr0range.com/a-new-lolbin-using-the-windows-type-command-to-upload-download-files-81d7b6179e22
author: Huntrule Team
date: 2026-01-17
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    product: windows
    category: process_creation
detection:
    selection_upload:
        CommandLine|contains|all:
            - 'type '
            - ' > \\\\'
    selection_download:
        CommandLine|contains|all:
            - 'type \\\\'
            - ' > '
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium