Windows cmd.exe Command-Line Anomaly: Missing Spaces Around /c /k /r

Flags cmd.exe invocations with suspicious missing spaces around /c, /k, or /r based on process creation CommandLine patterns.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-08-23
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where cmd.exe is executed with a /c, /k, or /r flag but the command line is missing required surrounding spaces (e.g., 'cmd.exe/c' or 'cmd.exe /c' patterns not matching the expected spacing). Attackers may leverage inconsistent spacing patterns to evade simplistic parsing, hide intent, or introduce execution quirks during command construction. The detection relies on process_creation telemetry and string matching within the captured CommandLine field.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation

Suspicious Script Download via Curl and PowerShell by Dohdoor

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Windows cmd.exe Command-Line Anomaly: Missing Spaces Around /c /k /r

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-cmd-exe-process-creation-missing-space-around-c-k-r-execution-parameters-a16980c2

title: "Windows cmd.exe Command-Line Anomaly: Missing Spaces Around /c /k /r"
id: db166242-bc15-41da-8b8a-f3e7e8ac9fb1
status: test
description: This rule flags Windows process creation events where cmd.exe is executed with a /c, /k, or /r flag but the command line is missing required surrounding spaces (e.g., 'cmd.exe/c' or 'cmd.exe /c' patterns not matching the expected spacing). Attackers may leverage inconsistent spacing patterns to evade simplistic parsing, hide intent, or introduce execution quirks during command construction. The detection relies on process_creation telemetry and string matching within the captured CommandLine field.
references:
  - https://twitter.com/cyb3rops/status/1562072617552678912
  - https://ss64.com/nt/cmd.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-23
modified: 2026-05-13
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains:
      - cmd.exe/c
      - \cmd/c
      - '"cmd/c'
      - cmd.exe/k
      - \cmd/k
      - '"cmd/k'
      - cmd.exe/r
      - \cmd/r
      - '"cmd/r'
  selection2:
    CommandLine|contains:
      - /cwhoami
      - /cpowershell
      - /cschtasks
      - /cbitsadmin
      - /ccertutil
      - /kwhoami
      - /kpowershell
      - /kschtasks
      - /kbitsadmin
      - /kcertutil
  selection3:
    CommandLine|contains:
      - cmd.exe /c
      - cmd /c
      - cmd.exe /k
      - cmd /k
      - cmd.exe /r
      - cmd /r
  filter_generic:
    CommandLine|contains:
      - "cmd.exe /c "
      - "cmd /c "
      - "cmd.exe /k "
      - "cmd /k "
      - "cmd.exe /r "
      - "cmd /r "
  filter_fp:
    - CommandLine|contains: AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules
    - CommandLine|endswith: cmd.exe/c .
    - CommandLine: cmd.exe /c
    - CommandLine: cmd /c
  condition: 1 of selection* and not 1 of filter_*
falsepositives:
  - Legitimate use of cmd.exe with no arguments e.g. via system("") in C to enable ANSI escape codes
level: high
license: DRL-1.1
related:
  - id: a16980c2-0c56-4de0-9a79-17971979efdd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL