Windows PowerShell execution via obfuscated cmd SET environment variables

Alerts on cmd.exe command lines that use obfuscated environment-variable SET to execute PowerShell.

FreeUnreviewedSigmahighv1

windows-powershell-execution-via-obfuscated-cmd-set-environment-variables-27aec9c9

title: Windows PowerShell execution via obfuscated cmd SET environment variables
id: f36e3df0-0b36-46a9-aa05-cf1922d4ca72
status: test
description: This rule flags Windows process creation where cmd.exe is invoked with embedded, obfuscated SET commands that use environment variables to construct and execute PowerShell. Obfuscating variable names and command structure can help attackers evade simple detections and hide the true execution path. The detection relies on process creation telemetry, specifically matching suspicious cmd.exe command-line patterns containing obfuscated SET operations followed by PowerShell-related execution.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2024-04-15
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re: cmd.{0,5}(?:/c|/r)(?:\s|)\"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\\"\s+?\-f(?:.*\)){1,}.*\"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 27aec9c9-dbb0-4939-8422-1742242471d0
    type: derived

What it detects

This rule flags Windows process creation where cmd.exe is invoked with embedded, obfuscated SET commands that use environment variables to construct and execute PowerShell. Obfuscating variable names and command structure can help attackers evade simple detections and hide the true execution path. The detection relies on process creation telemetry, specifically matching suspicious cmd.exe command-line patterns containing obfuscated SET operations followed by PowerShell-related execution.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.