huntrule

Suspicious cmd.exe Launching Encoded PowerShell From Shortcut File

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-09
Updated
2026-10-09
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects cmd.exe spawning PowerShell with an encoded command, a chain used by the Maverick banking Trojan distributed through WhatsApp. The malicious LNK launches cmd.exe which decodes and passes an obfuscated command to PowerShell. This layered command interpreter abuse is a common initial-access execution pattern designed to hide the real payload from casual inspection.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious Encoded PowerShell Spawned from Explorer via ClickFix
Malicious Office Application Spawning Command Interpreter
Suspicious Office Application Spawning Script Interpreter
Suspicious Microsoft Word Spawning PowerShell
Malicious Office Application Spawning PowerShell with Encoded Command
Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)
Suspicious Encoded JScript Execution via WScript (via process_creation)
Suspicious Batch Fake Installer Spawning PowerShell Downloader via OXLoader
Malicious Web Browser Spawning Command or Script Interpreter
Suspicious cmd.exe Launching Encoded PowerShell From Shortcut File
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.