Windows Cmd.exe Redirection to AppData Temp .bin During Explorer-Initiated Execution

Flags explorer-launched cmd.exe commands that use /C and redirect output to AppData local temp .bin files.

FreeUnreviewedSigmahighv1

windows-cmd-exe-redirection-to-appdata-temp-bin-during-explorer-initiated-execut-7aaa5739

title: Windows Cmd.exe Redirection to AppData Temp .bin During Explorer-Initiated Execution
id: e54ffde2-83de-460b-b990-59a577b07f9e
status: test
description: This rule identifies a suspicious command executed by cmd.exe when its parent process is explorer.exe, where the command includes /C and redirects output to a .bin file under %AppData%\local\temp. Such redirection is commonly used by malware to stage or persist discovery output for later use. Detection relies on Windows process creation telemetry, including parent image, process image, and full command line.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Ursnif/proc_creation_win_malware_ursnif_cmd_redirection.yml
author: "@kostastsale, Huntrule Team"
date: 2023-07-16
tags:
  - attack.execution
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \explorer.exe
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - "/C "
      - " >> *\\AppData\\local\\temp\\*.bin"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 7aaa5739-12fc-41aa-b98b-23ec27d42bdf
    type: derived

What it detects

This rule identifies a suspicious command executed by cmd.exe when its parent process is explorer.exe, where the command includes /C and redirects output to a .bin file under %AppData%\local\temp. Such redirection is commonly used by malware to stage or persist discovery output for later use. Detection relies on Windows process creation telemetry, including parent image, process image, and full command line.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.