Windows Process CommandLine Matching 'choice /t %d /d y /n >nul' for Potential Backdoor Execution

title: Windows Process CommandLine Matching 'choice /t %d /d y /n >nul' for Potential Backdoor Execution
id: 6e148309-1e83-4a76-be4d-6fd6b84ba60b
status: test
description: This rule flags Windows process creation events where the command line contains the specific pattern 'choice /t %d /d y /n >nul'. Such a command can be used by automated scripts to force user confirmation in a non-interactive way, which may accompany malicious payload staging or backdoor activity. The detection relies on process_creation telemetry with CommandLine content on Windows hosts.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_broken_cmd.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-14
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: choice /t %d /d y /n >nul
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 477a5ed3-a374-4282-9f3b-ed94e159a108
    type: derived