huntrule

Windows Process Creation: Command Line Obfuscation via Escape Characters

Identifies Windows process command lines containing escape-character URL obfuscation patterns.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
juju4 (SigmaHQ), DRL 1.1
Published
2018-12-11
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the command line contains specific escape-character patterns often used to obfuscate URLs. Attackers may use these sequences to evade string-based detections and make command intent harder to read. It relies on process creation telemetry including the process CommandLine field matching the defined obfuscated substrings.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange
Malicious macOS Payload Decryption via openssl with Password
Malicious Payload Decryption via openssl AES-256-CBC
Suspicious certutil Decode or Remote Download
Malicious Base64 Decoded Shell Payload Execution
Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell
Suspicious lwp-download Retrieval of Remote File Masquerading as Image via 8220 Gang
Malicious PolarEdge QNAP Backdoor Dropper Script in Temp (via file_event)
Suspicious PowerShell Payload Extraction from PNG Polyglot via findstr
Suspicious Python Inline Deobfuscation and Execution One-Liner
Windows Process Creation: Command Line Obfuscation via Escape Characters
Pivot detection · T1140 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.