Windows Cmd.exe: SET /p file append/override pattern via set /p=
Alerts on Cmd.exe command lines containing SET /p= syntax that may be used with redirection to modify file contents.
FreeReviewedSigma · Low · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), MahirAli Khan (in/mahiralikhan) (SigmaHQ), DRL 1.1
- Published
- 2024-08-22
- Updated
- 2026-07-31
What it detects
This rule identifies command-line usage of Cmd.exe invoking the internal SET command with the /p flag followed immediately by '='. The pattern is often associated with indirect file content manipulation when combined with redirection such as '>>' to append data. It relies on process creation telemetry capturing the executable path and full command line arguments.
Reporting behind it
- news.sophos.comhttps://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
- ss64.comhttps://ss64.com/nt/set.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_cmd_set_prompt_abuse.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-cmd-exe-set-p-file-append-override-pattern-65e4c134
title: "Windows Cmd.exe: SET /p file append/override pattern via set /p="
id: 1ed6ed27-2af7-4cb4-800c-cf9fdc23eead
status: test
description: This rule identifies command-line usage of Cmd.exe invoking the internal SET command with the /p flag followed immediately by '='. The pattern is often associated with indirect file content manipulation when combined with redirection such as '>>' to append data. It relies on process creation telemetry capturing the executable path and full command line arguments.
references:
- https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
- https://ss64.com/nt/set.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_cmd_set_prompt_abuse.yml
author: Nasreddine Bencherchali (Nextron Systems), MahirAli Khan (in/mahiralikhan), Huntrule Team
date: 2024-08-22
tags:
- attack.execution
- detection.threat-hunting
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \cmd.exe
- OriginalFileName: Cmd.Exe
selection_cli:
CommandLine|contains:
- /c set /p=
- '"set /p='
- ">>*set /p="
condition: all of selection_*
falsepositives:
- Legitimate use of the SET with the "/p" flag for user prompting. command in administrative scripts or user-generated scripts.
level: low
license: DRL-1.1
related:
- id: 65e4c134-ee52-4099-9e35-5e17a4b45c62
type: derived