Windows Process Command Line Matching Goofy-Guineapig Backdoor Command Fragment
Alerts on Windows process command lines containing a specific non-interactive choice command often used in automation.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-14
- Updated
- 2026-07-31
What it detects
This rule flags Windows process executions whose command line contains the specific fragment "choice /t %d /d y /n >nul" associated with the Goofy-Guineapig backdoor behavior described in the referenced NCSC report. Such timing and prompt-bypass commands can be used to support automated execution or staging in malware workflows. Detection relies on process creation telemetry that includes the full command line for each started process.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-commandline-matching-choice-t-d-d-y-n-nul-for-potential-backdoor-477a5ed3
title: Windows Process Command Line Matching Goofy-Guineapig Backdoor Command Fragment
id: 6e148309-1e83-4a76-be4d-6fd6b84ba60b
status: test
description: This rule flags Windows process executions whose command line contains the specific fragment "choice /t %d /d y /n >nul" associated with the Goofy-Guineapig backdoor behavior described in the referenced NCSC report. Such timing and prompt-bypass commands can be used to support automated execution or staging in malware workflows. Detection relies on process creation telemetry that includes the full command line for each started process.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_broken_cmd.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-14
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: choice /t %d /d y /n >nul
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 477a5ed3-a374-4282-9f3b-ed94e159a108
type: derived