Windows Process Command-Line Dosfuscation Pattern Detection (Potential Obfuscation)
Alerts on Windows command lines containing known dosfuscation-style obfuscation patterns.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-02-15
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events whose command line contains specific character patterns commonly used for payload obfuscation. Attackers may use these transformations to hinder detection and make malicious commands harder to analyze. The detection relies on process creation telemetry with access to the full command-line string.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-command-line-dosfuscation-obfuscation-indicators-a77c1610
title: Windows Process Command-Line Dosfuscation Pattern Detection (Potential Obfuscation)
id: 5847beb6-95cd-4418-91ff-b6348db727b0
status: test
description: This rule flags Windows process creation events whose command line contains specific character patterns commonly used for payload obfuscation. Attackers may use these transformations to hinder detection and make malicious commands harder to analyze. The detection relies on process creation telemetry with access to the full command-line string.
references:
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
- https://github.com/danielbohannon/Invoke-DOSfuscation
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-02-15
modified: 2023-03-06
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- ^^
- ^|^
- ",;,"
- ;;;;
- ;; ;;
- (,(,
- "%COMSPEC:~"
- " c^m^d"
- ^c^m^d
- " c^md"
- " cm^d"
- ^cm^d
- " s^et "
- " s^e^t "
- " se^t "
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: a77c1610-fc73-4019-8e29-0f51efc04a51
type: derived