Windows Code Page Change via MODE.COM

title: Windows Code Page Change via MODE.COM
id: 3e0928dd-4294-4a80-a1ee-22bb3ca30076
related:
  - id: 12fbff88-16b5-4b42-9754-cd001a789fb3
    type: derived
  - id: d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
    type: derived
status: test
description: This rule flags process creation events where MODE.COM is executed with command-line arguments indicating a console code page selection. Attackers may use code page changes to alter text encoding behavior and hinder analysis or operator visibility during activity. It relies on Windows process creation telemetry, matching the MODE.COM binary and specific command-line patterns consistent with code page modification.
references:
  - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode
  - https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html
  - https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_mode_codepage_change.yml
author: Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-01-19
tags:
  - attack.stealth
  - attack.t1036
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mode.com
    - OriginalFileName: MODE.COM
  selection_cli:
    CommandLine|contains|all:
      - " con "
      - " cp "
      - " select="
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1