Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Flags cmdl32.exe executions using /vpn and /lan that may indicate arbitrary file retrieval behavior.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2021-11-03
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of cmdl32.exe where the command line includes both /vpn and /lan. Cmdl32 can be abused to retrieve arbitrary files using a configuration file, so this pattern is a useful indicator of suspicious download behavior. Telemetry relies on Windows process creation fields including Image/OriginalFileName and full CommandLine content.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows: Suspicious Child Process Spawned by VsCode code.exe

Windows WSL Process Spawning Uncommon Child Executables

Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution

Windows renamed dctask64.exe execution via known IMPHASH values

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Pivot detection · T1202 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-cmdl32-exe-executed-with-vpn-and-lan-flags-f37aba28

title: "Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags"
id: 0d2749e5-4cf2-4c01-9e59-43522fab9e34
status: test
description: This rule flags process executions of cmdl32.exe where the command line includes both /vpn and /lan. Cmdl32 can be abused to retrieve arbitrary files using a configuration file, so this pattern is a useful indicator of suspicious download behavior. Telemetry relies on Windows process creation fields including Image/OriginalFileName and full CommandLine content.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/
  - https://twitter.com/SwiftOnSecurity/status/1455897435063074824
  - https://github.com/LOLBAS-Project/LOLBAS/pull/151
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml
author: frack113, Huntrule Team
date: 2021-11-03
modified: 2024-04-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmdl32.exe
    - OriginalFileName: CMDL32.EXE
  selection_cli:
    CommandLine|contains|all:
      - /vpn
      - /lan
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f37aba28-a9e6-4045-882c-d5004043b337
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL