Potentially Suspicious CMD Shell Output Redirect (via process_creation)

title: Potentially Suspicious CMD Shell Output Redirect (via process_creation)
id: 9c56bd3e-bea5-5ce1-9c71-d0405aff859e
status: stable
description: This rule detects inline Windows shell commands redirecting output via the ">" symbol to an anomalous location. This method is sometimes used by hostile actors to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
author: Huntrule Team
date: 2026-03-15
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_cli_1:
        CommandLine|contains:
            - '>?%APPDATA%\'
            - '>?%TEMP%\'
            - '>?%TMP%\'
            - '>?%USERPROFILE%\'
            - '>?C:\ProgramData\'
            - '>?C:\Temp\'
            - '>?C:\Users\Public\'
            - '>?C:\Windows\Temp\'
    selection_cli_2:
        CommandLine|contains:
            - ' >'
            - '">'
            - "'>"
        CommandLine|contains|all:
            - 'C:\Users\'
            - '\AppData\Local\'
    condition: selection_img and 1 of selection_cli_*
falsepositives:
    - Unknown
level: medium