Windows Process Command Line Matching Goofy-Guineapig Backdoor Command Fragment

Alerts on Windows process command lines containing a specific non-interactive choice command often used in automation.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-14
Updated
2026-07-31
title: Windows Process Command Line Matching Goofy-Guineapig Backdoor Command Fragment
id: 6e148309-1e83-4a76-be4d-6fd6b84ba60b
status: test
description: This rule flags Windows process executions whose command line contains the specific fragment "choice /t %d /d y /n >nul" associated with the Goofy-Guineapig backdoor behavior described in the referenced NCSC report. Such timing and prompt-bypass commands can be used to support automated execution or staging in malware workflows. Detection relies on process creation telemetry that includes the full command line for each started process.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_broken_cmd.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-14
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: choice /t %d /d y /n >nul
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 477a5ed3-a374-4282-9f3b-ed94e159a108
    type: derived