huntrule

Suspicious File Concatenation via copy Binary Mode

PremiumReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-25
Updated
2026-09-25
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the command shell copy utility used in binary mode to concatenate multiple files into one, a payload-assembly technique observed in a Lumma infostealer campaign that combined an AutoIt interpreter with a script to reconstruct an executable. It captures the joining of staged fragments into a runnable payload on disk. Detecting this is important because copy /b concatenation of separate files is an established malware building technique that reassembles payloads to evade detection.

Reporting behind it

Related detections9 linkedT1059.003 — drag to rearrange
Suspicious Subtitle File Parsing for Staged Command Execution
Suspicious CAB Extraction via extrac32 LOLBin
Suspicious Hidden PowerShell Launched by Batch Script
Suspicious Command Shell Executing Batch Script from LNK Delivery
Suspicious Office Application Spawning Script Interpreter Chain
Malicious RoKRAT Staged Loader Files in Temp via LNK (via file_event)
Malicious Command Execution Spawned by SharePoint w3wp Worker Process
Suspicious Ballistic Bobcat Backdoor Command Output Redirection via Cmd (via process_creation)
Suspicious PIF Payload Assembly via copy /b Binary Concatenation
Suspicious File Concatenation via copy Binary Mode
Pivot detection · T1059.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.