Windows CHCP Console Code Page Lookup Triggered From cmd.exe
Flags cmd.exe-launched chcp.com executions likely used to query system code page/locale for discovery.
- Product
- windows
- Category
- process_creation
- Author
- _pete_0, TheDFIRReport (SigmaHQ), DRL 1.1
- Published
- 2022-02-21
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation where cmd.exe launches chcp.com with a command line that invokes CHCP. The activity is used to query system code page or locale-related values during host discovery, which can support reconnaissance prior to other actions. It relies on Windows process creation telemetry including ParentImage, ParentCommandLine, Image, and CommandLine fields.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows CHCP Console Code Page Lookup Triggered From cmd.exe
id: 9084ce97-0102-402d-afdb-c5fbc0bf6533
status: test
description: This rule identifies process creation where cmd.exe launches chcp.com with a command line that invokes CHCP. The activity is used to query system code page or locale-related values during host discovery, which can support reconnaissance prior to other actions. It relies on Windows process creation telemetry including ParentImage, ParentCommandLine, Image, and CommandLine fields.
references:
- https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup.yml
author: _pete_0, TheDFIRReport, Huntrule Team
date: 2022-02-21
modified: 2024-03-05
tags:
- attack.discovery
- attack.t1614.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \cmd.exe
ParentCommandLine|contains|windash:
- " -c "
- " -r "
- " -k "
Image|endswith: \chcp.com
CommandLine|endswith:
- chcp
- "chcp "
- "chcp "
condition: selection
falsepositives:
- During Anaconda update the 'conda.exe' process will eventually execution the 'chcp' command.
- Discord was seen using chcp to look up code pages
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup/info.yml
license: DRL-1.1
related:
- id: 7090adee-82e2-4269-bd59-80691e7c6338
type: derived