Windows cmd.exe Process Creation: Missing Space Around /c /k /r Execution Parameters

Flags cmd.exe invocations with suspicious missing spaces around /c, /k, or /r based on process creation CommandLine patterns.

FreeUnreviewedSigmahighv1

windows-cmd-exe-process-creation-missing-space-around-c-k-r-execution-parameters-a16980c2

title: "Windows cmd.exe Process Creation: Missing Space Around /c /k /r Execution Parameters"
id: db166242-bc15-41da-8b8a-f3e7e8ac9fb1
status: test
description: This rule identifies Windows command lines where cmd.exe is invoked with missing space characters adjacent to /c, /k, or /r (e.g., cmd.exe/c or missing whitespace after /c). Such formatting anomalies can be used to disguise the real command being passed to cmd.exe or to reflect atypical/incorrect command construction. It relies on process creation telemetry with access to the full CommandLine field to match specific string patterns while excluding known benign cases and generic whitespace variants.
references:
  - https://twitter.com/cyb3rops/status/1562072617552678912
  - https://ss64.com/nt/cmd.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-23
modified: 2026-05-13
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains:
      - cmd.exe/c
      - \cmd/c
      - '"cmd/c'
      - cmd.exe/k
      - \cmd/k
      - '"cmd/k'
      - cmd.exe/r
      - \cmd/r
      - '"cmd/r'
  selection2:
    CommandLine|contains:
      - /cwhoami
      - /cpowershell
      - /cschtasks
      - /cbitsadmin
      - /ccertutil
      - /kwhoami
      - /kpowershell
      - /kschtasks
      - /kbitsadmin
      - /kcertutil
  selection3:
    CommandLine|contains:
      - cmd.exe /c
      - cmd /c
      - cmd.exe /k
      - cmd /k
      - cmd.exe /r
      - cmd /r
  filter_generic:
    CommandLine|contains:
      - "cmd.exe /c "
      - "cmd /c "
      - "cmd.exe /k "
      - "cmd /k "
      - "cmd.exe /r "
      - "cmd /r "
  filter_fp:
    - CommandLine|contains: AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules
    - CommandLine|endswith: cmd.exe/c .
    - CommandLine: cmd.exe /c
    - CommandLine: cmd /c
  condition: 1 of selection* and not 1 of filter_*
falsepositives:
  - Legitimate use of cmd.exe with no arguments e.g. via system("") in C to enable ANSI escape codes
level: high
license: DRL-1.1
related:
  - id: a16980c2-0c56-4de0-9a79-17971979efdd
    type: derived

What it detects

This rule identifies Windows command lines where cmd.exe is invoked with missing space characters adjacent to /c, /k, or /r (e.g., cmd.exe/c or missing whitespace after /c). Such formatting anomalies can be used to disguise the real command being passed to cmd.exe or to reflect atypical/incorrect command construction. It relies on process creation telemetry with access to the full CommandLine field to match specific string patterns while excluding known benign cases and generic whitespace variants.

Known false positives

Legitimate use of cmd.exe with no arguments e.g. via system("") in C to enable ANSI escape codes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.