Windows: Detect Cmd.exe Redirection of Discovery Commands by Ursnif
Flags explorer-launched cmd.exe commands that use /C and redirect output to AppData local temp .bin files.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2023-07-16
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies a specific execution pattern where a cmd.exe process launched from explorer.exe runs a command containing '/C ' and redirects output to a temporary .bin file under AppData\local\temp\*.bin. Attackers commonly use command execution and output redirection during staging to capture discovery results or prepare follow-on steps. The detection relies on process creation telemetry, including parent image, command line content, and the presence of the output redirection target path.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect Cmd.exe Redirection of Discovery Commands by Ursnif"
id: e54ffde2-83de-460b-b990-59a577b07f9e
status: test
description: This rule identifies a specific execution pattern where a cmd.exe process launched from explorer.exe runs a command containing '/C ' and redirects output to a temporary .bin file under AppData\local\temp\*.bin. Attackers commonly use command execution and output redirection during staging to capture discovery results or prepare follow-on steps. The detection relies on process creation telemetry, including parent image, command line content, and the presence of the output redirection target path.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Ursnif/proc_creation_win_malware_ursnif_cmd_redirection.yml
author: "@kostastsale, Huntrule Team"
date: 2023-07-16
tags:
- attack.execution
- attack.t1059
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \explorer.exe
Image|endswith: \cmd.exe
CommandLine|contains|all:
- "/C "
- " >> *\\AppData\\local\\temp\\*.bin"
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 7aaa5739-12fc-41aa-b98b-23ec27d42bdf
type: derived