Windows Process Command-Line Dosfuscation Pattern Detection (Potential Obfuscation)

title: Windows Process Command-Line Dosfuscation Pattern Detection (Potential Obfuscation)
id: 5847beb6-95cd-4418-91ff-b6348db727b0
status: test
description: This rule flags Windows process creation events whose command line contains specific character patterns commonly used for payload obfuscation. Attackers may use these transformations to hinder detection and make malicious commands harder to analyze. The detection relies on process creation telemetry with access to the full command-line string.
references:
  - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
  - https://github.com/danielbohannon/Invoke-DOSfuscation
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-02-15
modified: 2023-03-06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ^^
      - ^|^
      - ",;,"
      - ;;;;
      - ;; ;;
      - (,(,
      - "%COMSPEC:~"
      - " c^m^d"
      - ^c^m^d
      - " c^md"
      - " cm^d"
      - ^cm^d
      - " s^et "
      - " s^e^t "
      - " se^t "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a77c1610-fc73-4019-8e29-0f51efc04a51
    type: derived