Windows cmd.exe Executing start Utility with Hidden Window Flags (/b or /min)

title: Windows cmd.exe Executing start Utility with Hidden Window Flags (/b or /min)
id: 94091e76-c6b9-44e5-bc1e-00e4552989ab
status: experimental
description: This rule identifies process executions where cmd.exe launches the Windows start utility using hidden or minimized execution flags (/b or /min) aimed at suspicious targets. Using hidden window flags can reduce user visibility while running additional payloads from attacker-controlled or less-trusted locations. The detection relies on Windows process creation telemetry, specifically the cmd.exe image/original file name and the constructed command line content combined with target indicators such as script extensions or common suspicious directories.
references:
  - https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous
  - https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
  - https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml
tags:
  - attack.stealth
  - attack.t1564.003
author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-24
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cmd_hidden_start_1:
    CommandLine|contains|windash:
      - "start "
      - start/b
      - start/min
  selection_cmd_hidden_start_2:
    CommandLine|contains|windash:
      - "/b "
      - /b"
      - "/min "
      - /min"
  selection_cli_uncommon_location:
    CommandLine|contains:
      - :\Perflogs\
      - :\Temp\
      - :\Users\Default\
      - :\Windows\Temp\
      - \AppData\Roaming\
      - \Contacts\
      - \Documents\
      - \Downloads\
      - \Favorites\
      - \Favourites\
      - \inetpub\
      - \Music\
      - \Photos\
      - \Temporary Internet\
      - \Users\Public\
      - \Videos\
  selection_cli_susp_extension:
    CommandLine|contains:
      - .bat
      - .cmd
      - .cpl
      - .hta
      - .js
      - .ps1
      - .scr
      - .vbe
      - .vbs
  selection_cli_susp_pattern:
    CommandLine|contains:
      - " -nop "
      - " -sta "
      - .downloadfile(
      - .downloadstring(
      - "-noni "
      - "-w hidden "
  condition: all of selection_cmd_* and 1 of selection_cli_*
falsepositives:
  - Legitimate administrative scripts running from temporary folders.
  - Niche software updaters utilizing hidden batch files in ProgramData.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml
license: DRL-1.1
related:
  - id: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d
    type: derived