huntrule

Windows Process Creation: Command Line Obfuscation via Escape Characters

Identifies Windows process command lines containing escape-character URL obfuscation patterns.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
juju4 (SigmaHQ), DRL 1.1
Published
2018-12-11
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the command line contains specific escape-character patterns often used to obfuscate URLs. Attackers may use these sequences to evade string-based detections and make command intent harder to read. It relies on process creation telemetry including the process CommandLine field matching the defined obfuscated substrings.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange
Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)
Hidden PowerShell Archive Extraction via ExtractToDirectory
Malicious Shell Payload Piped from curl to zsh
CastleLoader ClickFix PowerShell Hex Decode and Re-Execution
Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32
Suspicious tar Extraction of Staged Archive to Temp (via process_creation)
Malicious Multi Layer Base64 Decoded Payload Execution via Bash (via process_creation)
Malicious Certutil Decode of Encoded Web Shell to ASPX (via process_creation)
Obfuscated File Decoding via Certutil (via process_creation)
Windows Process Creation: Command Line Obfuscation via Escape Characters
Pivot detection · T1140 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.