Windows Cmd.exe SET /p File Append/Override Pattern

Alerts on Cmd.exe command lines containing SET /p= syntax that may be used with redirection to modify file contents.

FreeUnreviewedSigmalowv1

windows-cmd-exe-set-p-file-append-override-pattern-65e4c134

title: Windows Cmd.exe SET /p File Append/Override Pattern
id: 1ed6ed27-2af7-4cb4-800c-cf9fdc23eead
status: test
description: This rule flags process executions of Windows Cmd.exe where the command line includes the internal command SET with the /p flag immediately followed by an equals sign. It is relevant because that syntax can be combined with redirection (including append-style operators) to influence file contents indirectly. The detection relies on process creation telemetry, matching Cmd.Exe image/identity and specific command-line substrings indicating "set /p=" and potential " >>" redirection context.
references:
  - https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
  - https://ss64.com/nt/set.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_cmd_set_prompt_abuse.yml
author: Nasreddine Bencherchali (Nextron Systems), MahirAli Khan (in/mahiralikhan), Huntrule Team
date: 2024-08-22
tags:
  - attack.execution
  - detection.threat-hunting
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cli:
    CommandLine|contains:
      - /c set /p=
      - '"set /p='
      - ">>*set /p="
  condition: all of selection_*
falsepositives:
  - Legitimate use of the SET with the "/p" flag for user prompting. command in administrative scripts or user-generated scripts.
level: low
license: DRL-1.1
related:
  - id: 65e4c134-ee52-4099-9e35-5e17a4b45c62
    type: derived

What it detects

This rule flags process executions of Windows Cmd.exe where the command line includes the internal command SET with the /p flag immediately followed by an equals sign. It is relevant because that syntax can be combined with redirection (including append-style operators) to influence file contents indirectly. The detection relies on process creation telemetry, matching Cmd.Exe image/identity and specific command-line substrings indicating "set /p=" and potential " >>" redirection context.

Known false positives

Legitimate use of the SET with the "/p" flag for user prompting. command in administrative scripts or user-generated scripts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.