Windows: CHCP Console Command Used for Code Page/Locale Lookup Discovery

Flags cmd.exe-launched chcp.com executions likely used to query system code page/locale for discovery.

FreeUnreviewedSigmamediumv1

windows-chcp-console-command-used-for-code-page-locale-lookup-discovery-7090adee

title: "Windows: CHCP Console Command Used for Code Page/Locale Lookup Discovery"
id: 9084ce97-0102-402d-afdb-c5fbc0bf6533
status: test
description: This rule identifies process executions of chcp.com (or equivalent cmd invocation) where cmd.exe is the parent and the command line calls chcp. Attackers and legitimate tooling may use CHCP to query the system code page/locale as part of host discovery before staging language- or encoding-dependent actions. It relies on Windows process creation telemetry, matching parent process and specific command-line patterns used to invoke chcp.
references:
  - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup.yml
author: _pete_0, TheDFIRReport, Huntrule Team
date: 2022-02-21
modified: 2024-03-05
tags:
  - attack.discovery
  - attack.t1614.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \cmd.exe
    ParentCommandLine|contains|windash:
      - " -c "
      - " -r "
      - " -k "
    Image|endswith: \chcp.com
    CommandLine|endswith:
      - chcp
      - "chcp "
      - "chcp  "
  condition: selection
falsepositives:
  - During Anaconda update the 'conda.exe' process will eventually execution the 'chcp' command.
  - Discord was seen using chcp to look up code pages
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup/info.yml
license: DRL-1.1
related:
  - id: 7090adee-82e2-4269-bd59-80691e7c6338
    type: derived

What it detects

This rule identifies process executions of chcp.com (or equivalent cmd invocation) where cmd.exe is the parent and the command line calls chcp. Attackers and legitimate tooling may use CHCP to query the system code page/locale as part of host discovery before staging language- or encoding-dependent actions. It relies on Windows process creation telemetry, matching parent process and specific command-line patterns used to invoke chcp.

Known false positives

During Anaconda update the 'conda.exe' process will eventually execution the 'chcp' command.
Discord was seen using chcp to look up code pages

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.