Windows Process Creation: Command-Line Dosfuscation Obfuscation Indicators

title: "Windows Process Creation: Command-Line Dosfuscation Obfuscation Indicators"
id: 5847beb6-95cd-4418-91ff-b6348db727b0
status: test
description: This rule flags Windows process creation events where the command line contains specific character-pattern indicators associated with payload obfuscation. Attackers may use these transformations to evade detections and hinder analysis while still executing the intended commands. It relies on process creation telemetry, specifically the full command line captured at process start, and matches only when those exact obfuscation-like substrings are present.
references:
  - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
  - https://github.com/danielbohannon/Invoke-DOSfuscation
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-02-15
modified: 2023-03-06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ^^
      - ^|^
      - ",;,"
      - ;;;;
      - ;; ;;
      - (,(,
      - "%COMSPEC:~"
      - " c^m^d"
      - ^c^m^d
      - " c^md"
      - " cm^d"
      - ^cm^d
      - " s^et "
      - " s^e^t "
      - " se^t "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a77c1610-fc73-4019-8e29-0f51efc04a51
    type: derived