Windows CHCP Code Page Switch via chcp.com in Command Line/BAT

Alerts on suspicious chcp.com usage that switches Windows code pages to specific rare identifiers in process creation logs.

FreeUnreviewedSigmamediumv1

windows-chcp-code-page-switch-via-chcp-com-in-command-line-bat-c7942406

title: Windows CHCP Code Page Switch via chcp.com in Command Line/BAT
id: a4287a7f-e7f0-41c8-ad29-8271d35ab68c
status: test
description: This rule flags process executions where chcp.com is run from the command line or batch context and the command line ends with specific code page identifiers associated with less common locales. Attackers can use code page changes to influence how text is encoded or displayed, which may support stealthy execution, localization-dependent behavior, or evasion of simple text-based monitoring. The detection relies on Windows process creation telemetry, matching the image name and the exact ending of the command line.
references:
  - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  - https://twitter.com/cglyer/status/1183756892952248325
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2019-10-14
modified: 2023-03-07
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \chcp.com
    CommandLine|endswith:
      - " 936"
      - " 1258"
  condition: selection
falsepositives:
  - Administrative activity (adjust code pages according to your organization's region)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch/info.yml
license: DRL-1.1
related:
  - id: c7942406-33dd-4377-a564-0f62db0593a3
    type: derived

What it detects

This rule flags process executions where chcp.com is run from the command line or batch context and the command line ends with specific code page identifiers associated with less common locales. Attackers can use code page changes to influence how text is encoded or displayed, which may support stealthy execution, localization-dependent behavior, or evasion of simple text-based monitoring. The detection relies on Windows process creation telemetry, matching the image name and the exact ending of the command line.

Known false positives

Administrative activity (adjust code pages according to your organization's region)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.