huntrule

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Flags cmdl32.exe executions using /vpn and /lan that may indicate arbitrary file retrieval behavior.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-11-03
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions of cmdl32.exe where the command line includes both /vpn and /lan. Cmdl32 can be abused to retrieve arbitrary files using a configuration file, so this pattern is a useful indicator of suspicious download behavior. Telemetry relies on Windows process creation fields including Image/OriginalFileName and full CommandLine content.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange
Windows ConHost Spawning Suspicious Script and Command-Line Child Processes
Suspicious Child Process Creation from BgInfo.EXE on Windows
Windows: Suspicious Child Process Spawned by VsCode code.exe
Windows WSL Process Spawning Uncommon Child Executables
Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables
Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable
Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP
Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution
Windows renamed dctask64.exe execution via known IMPHASH values
Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags
Pivot detection · T1202 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.