Windows Code Page Change via mode.com Selecting Russian Code Pages
Alerts when mode.com is used to set console code pages to Russian values (1251 or 866).
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
- Published
- 2024-01-17
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process execution of mode.com that changes the console code page to Russian-related values (cp select=1251 or cp select=866). Attackers may use code page changes to influence how text is rendered, potentially aiding stealth or operator activity. It relies on Windows process creation telemetry capturing the executable name/path and command-line parameters.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode
- strontic.github.iohttps://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html
- virustotal.comhttps://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-code-page-change-via-mode-com-selecting-russian-code-pages-12fbff88
title: Windows Code Page Change via mode.com Selecting Russian Code Pages
id: 7bf1c9c2-b672-4275-b307-8fa487567845
related:
- id: d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
type: derived
- id: 12fbff88-16b5-4b42-9754-cd001a789fb3
type: derived
status: test
description: This rule flags process execution of mode.com that changes the console code page to Russian-related values (cp select=1251 or cp select=866). Attackers may use code page changes to influence how text is rendered, potentially aiding stealth or operator activity. It relies on Windows process creation telemetry capturing the executable name/path and command-line parameters.
references:
- https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode
- https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html
- https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-01-17
tags:
- attack.stealth
- attack.t1036
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \mode.com
- OriginalFileName: MODE.COM
selection_cli:
CommandLine|contains|all:
- " con "
- " cp "
- " select="
CommandLine|endswith:
- =1251
- =866
condition: all of selection_*
falsepositives:
- Russian speaking people changing the CodePage
level: medium
license: DRL-1.1