Windows cmd.exe Command-Line Output Redirection to Suspicious User or System Paths

Flags cmd.exe commands that redirect output (>) into temp/AppData and other commonly targeted directories.

FreeUnreviewedSigmamediumv1

windows-cmd-exe-command-line-output-redirection-to-suspicious-user-or-system-pat-8e0bb260

title: Windows cmd.exe Command-Line Output Redirection to Suspicious User or System Paths
id: 7b236dd9-7f7a-41f1-ad5e-4bb602e5891e
related:
  - id: aa2efee7-34dd-446e-8a37-40790a66efd7
    type: derived
  - id: 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
    type: similar
  - id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892
    type: derived
status: test
description: This rule flags Windows process creation where cmd.exe is invoked and the command line includes output redirection using the '>'/append-style redirection toward commonly abused file locations. Attackers may use this to store the results of commands for later review or exfiltration, including recon-style output written to user profiles, temp directories, or AppData. It relies on process creation telemetry with Image/OriginalFileName fields and a command-line string match for the redirection operators and targeted directory paths.
references:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_redirection_susp_folder.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-12
modified: 2024-03-19
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cli_1:
    CommandLine|contains:
      - ">?%APPDATA%\\"
      - ">?%TEMP%\\"
      - ">?%TMP%\\"
      - ">?%USERPROFILE%\\"
      - ">?C:\\ProgramData\\"
      - ">?C:\\Temp\\"
      - ">?C:\\Users\\Public\\"
      - ">?C:\\Windows\\Temp\\"
  selection_cli_2:
    CommandLine|contains:
      - " >"
      - '">'
      - "'>"
    CommandLine|contains|all:
      - C:\Users\
      - \AppData\Local\
  condition: selection_img and 1 of selection_cli_*
falsepositives:
  - Legitimate admin or third party scripts used for diagnostic collection might generate some false positives
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation where cmd.exe is invoked and the command line includes output redirection using the '>'/append-style redirection toward commonly abused file locations. Attackers may use this to store the results of commands for later review or exfiltration, including recon-style output written to user profiles, temp directories, or AppData. It relies on process creation telemetry with Image/OriginalFileName fields and a command-line string match for the redirection operators and targeted directory paths.

Known false positives

Legitimate admin or third party scripts used for diagnostic collection might generate some false positives

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.