Suspicious CodePage Switch Through CHCP (via process_creation)

title: Suspicious CodePage Switch Through CHCP (via process_creation)
id: e1b7b2f3-d96d-5c92-b385-68c08a5b9d97
status: stable
description: This rule detects a code page switch in command line or batch scripts to a rare language
references:
    - https://attack.mitre.org/techniques/T1036/
    - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
    - https://twitter.com/cglyer/status/1183756892952248325
author: Huntrule Team
date: 2026-07-25
tags:
    - attack.stealth
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\chcp.com'
        CommandLine|endswith:
            - ' 936'
            - ' 1258'
    condition: selection
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch/info.yml