Windows cmd.exe Executing start Utility with Hidden Window Flags (/b or /min)
Alerts on cmd.exe invoking start.exe with /b or /min, especially when directed at scripts or files in suspicious temp/public paths.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-01-24
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions where cmd.exe launches the Windows start utility using hidden or minimized execution flags (/b or /min) aimed at suspicious targets. Using hidden window flags can reduce user visibility while running additional payloads from attacker-controlled or less-trusted locations. The detection relies on Windows process creation telemetry, specifically the cmd.exe image/original file name and the constructed command line content combined with target indicators such as script extensions or common suspicious directories.
Reporting behind it
- fortinet.comhttps://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous
- fortinet.comhttps://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
- fortinet.comhttps://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-cmd-exe-launching-start-exe-with-hidden-window-flags-to-script-or-suspic-5a6b7c8d
title: Windows cmd.exe Executing start Utility with Hidden Window Flags (/b or /min)
id: 94091e76-c6b9-44e5-bc1e-00e4552989ab
status: experimental
description: This rule identifies process executions where cmd.exe launches the Windows start utility using hidden or minimized execution flags (/b or /min) aimed at suspicious targets. Using hidden window flags can reduce user visibility while running additional payloads from attacker-controlled or less-trusted locations. The detection relies on Windows process creation telemetry, specifically the cmd.exe image/original file name and the constructed command line content combined with target indicators such as script extensions or common suspicious directories.
references:
- https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous
- https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
- https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml
tags:
- attack.stealth
- attack.t1564.003
author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-24
logsource:
category: process_creation
product: windows
detection:
selection_cmd_img:
- Image|endswith: \cmd.exe
- OriginalFileName: Cmd.Exe
selection_cmd_hidden_start_1:
CommandLine|contains|windash:
- "start "
- start/b
- start/min
selection_cmd_hidden_start_2:
CommandLine|contains|windash:
- "/b "
- /b"
- "/min "
- /min"
selection_cli_uncommon_location:
CommandLine|contains:
- :\Perflogs\
- :\Temp\
- :\Users\Default\
- :\Windows\Temp\
- \AppData\Roaming\
- \Contacts\
- \Documents\
- \Downloads\
- \Favorites\
- \Favourites\
- \inetpub\
- \Music\
- \Photos\
- \Temporary Internet\
- \Users\Public\
- \Videos\
selection_cli_susp_extension:
CommandLine|contains:
- .bat
- .cmd
- .cpl
- .hta
- .js
- .ps1
- .scr
- .vbe
- .vbs
selection_cli_susp_pattern:
CommandLine|contains:
- " -nop "
- " -sta "
- .downloadfile(
- .downloadstring(
- "-noni "
- "-w hidden "
condition: all of selection_cmd_* and 1 of selection_cli_*
falsepositives:
- Legitimate administrative scripts running from temporary folders.
- Niche software updaters utilizing hidden batch files in ProgramData.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml
license: DRL-1.1
related:
- id: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d
type: derived