Windows: Detect kavremover-related LOLBIN command-line usage

Alerts on Windows process executions with 'run run-cmd' using kavremover/cleanapi-style LOLBIN invocation patterns.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-11-01
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1127Trusted Developer Utilities Proxy Execution
Persistence
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation where the command line contains the substring ' run run-cmd ' and the parent process is not one of the expected kavremover or cleanapi executables. Such behavior can indicate misuse of a signed Kaspersky Lab Products Remover component as a LOLBIN to launch arbitrary commands or binaries. It relies on Windows process creation telemetry, specifically parent image paths and the full command line string.

Reporting behind it

Related detections9 linkedT1127 — drag to rearrange

Suspicious Code Compilation via Aspnet_compiler LOLBIN (via process_creation)

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Suspicious Child Process of aspnet_compiler.exe on Windows

Suspicious aspnet_compiler.exe Execution from User or Temp Paths on Windows

Windows node.exe Execution with -e/--eval and suspicious child process usage

Windows: Process creation involving VSIISExeLauncher.exe with -p and -a arguments

Windows Process Creation: Mftrace.exe Child Process Execution

Windows Process Creation: Remote.exe Execution

Windows Process Creation: wfc.exe Execution for Workflow Command-line Compiler Abuse

Windows: Detect kavremover-related LOLBIN command-line usage

Pivot detection · T1127 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-detect-kavremover-cleanapi-lolbin-style-command-line-execution-d047726b

title: "Windows: Detect kavremover-related LOLBIN command-line usage"
id: c5f2aaab-27c6-42f7-af41-fb166b844539
status: test
description: This rule identifies process creation where the command line contains the substring ' run run-cmd ' and the parent process is not one of the expected kavremover or cleanapi executables. Such behavior can indicate misuse of a signed Kaspersky Lab Products Remover component as a LOLBIN to launch arbitrary commands or binaries. It relies on Windows process creation telemetry, specifically parent image paths and the full command line string.
references:
  - https://nasbench.medium.com/lolbined-using-kaspersky-endpoint-security-kes-installer-to-execute-arbitrary-commands-1c999f1b7fea
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_kavremover_uncommon_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-01
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains: " run run-cmd "
  filter_main_legit_parents:
    ParentImage|endswith:
      - \cleanapi.exe
      - \kavremover.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d047726b-c71c-4048-a99b-2e2f50dc107d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL