Windows Code Page Change via mode.com Selecting Russian Code Pages

Alerts when mode.com is used to set console code pages to Russian values (1251 or 866).

FreeUnreviewedSigmamediumv1

windows-code-page-change-via-mode-com-selecting-russian-code-pages-12fbff88

title: Windows Code Page Change via mode.com Selecting Russian Code Pages
id: 7bf1c9c2-b672-4275-b307-8fa487567845
related:
  - id: d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
    type: derived
  - id: 12fbff88-16b5-4b42-9754-cd001a789fb3
    type: derived
status: test
description: This rule flags process execution of mode.com that changes the console code page to Russian-related values (cp select=1251 or cp select=866). Attackers may use code page changes to influence how text is rendered, potentially aiding stealth or operator activity. It relies on Windows process creation telemetry capturing the executable name/path and command-line parameters.
references:
  - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode
  - https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html
  - https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-01-17
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \mode.com
    - OriginalFileName: MODE.COM
  selection_cli:
    CommandLine|contains|all:
      - " con "
      - " cp "
      - " select="
    CommandLine|endswith:
      - =1251
      - =866
  condition: all of selection_*
falsepositives:
  - Russian speaking people changing the CodePage
level: medium
license: DRL-1.1

What it detects

This rule flags process execution of mode.com that changes the console code page to Russian-related values (cp select=1251 or cp select=866). Attackers may use code page changes to influence how text is rendered, potentially aiding stealth or operator activity. It relies on Windows process creation telemetry capturing the executable name/path and command-line parameters.

Known false positives

Russian speaking people changing the CodePage

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.