Windows cmd.exe Launching start.exe with Hidden Window Flags to Script or Suspicious Paths

title: Windows cmd.exe Launching start.exe with Hidden Window Flags to Script or Suspicious Paths
id: 94091e76-c6b9-44e5-bc1e-00e4552989ab
status: experimental
description: This rule flags process creation where cmd.exe runs the Windows start utility with hidden window flags (/b for no window or /min for minimized). It matters because attackers can use these flags to suppress visible UI and make execution harder to notice while targeting files in locations commonly abused for staging or execution. Detection relies on Windows process creation telemetry, matching cmd.exe command lines containing the start syntax and requiring the target to include either a suspicious script extension or appear in commonly suspicious temporary/public/utility directories.
references:
  - https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous
  - https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
  - https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml
tags:
  - attack.stealth
  - attack.t1564.003
author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-24
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cmd_hidden_start_1:
    CommandLine|contains|windash:
      - "start "
      - start/b
      - start/min
  selection_cmd_hidden_start_2:
    CommandLine|contains|windash:
      - "/b "
      - /b"
      - "/min "
      - /min"
  selection_cli_uncommon_location:
    CommandLine|contains:
      - :\Perflogs\
      - :\Temp\
      - :\Users\Default\
      - :\Windows\Temp\
      - \AppData\Roaming\
      - \Contacts\
      - \Documents\
      - \Downloads\
      - \Favorites\
      - \Favourites\
      - \inetpub\
      - \Music\
      - \Photos\
      - \Temporary Internet\
      - \Users\Public\
      - \Videos\
  selection_cli_susp_extension:
    CommandLine|contains:
      - .bat
      - .cmd
      - .cpl
      - .hta
      - .js
      - .ps1
      - .scr
      - .vbe
      - .vbs
  selection_cli_susp_pattern:
    CommandLine|contains:
      - " -nop "
      - " -sta "
      - .downloadfile(
      - .downloadstring(
      - "-noni "
      - "-w hidden "
  condition: all of selection_cmd_* and 1 of selection_cli_*
falsepositives:
  - Legitimate administrative scripts running from temporary folders.
  - Niche software updaters utilizing hidden batch files in ProgramData.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml
license: DRL-1.1
related:
  - id: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d
    type: derived