Windows Process Creation: Command Line Obfuscation via Escape Characters

title: "Windows Process Creation: Command Line Obfuscation via Escape Characters"
id: 7782379a-af1f-40c0-9647-44e6a7f5bfc0
status: test
description: This rule flags Windows process creation events where the command line contains specific escape-character patterns often used to obfuscate URLs. Attackers may use these sequences to evade string-based detections and make command intent harder to read. It relies on process creation telemetry including the process CommandLine field matching the defined obfuscated substrings.
references:
  - https://twitter.com/vysecurity/status/885545634958385153
  - https://twitter.com/Hexacorn/status/885553465417756673
  - https://twitter.com/Hexacorn/status/885570278637678592
  - https://www.mandiant.com/resources/blog/obfuscation-wild-targeted-attackers-lead-way-evasion-techniques
  - https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml
author: juju4, Huntrule Team
date: 2018-12-11
modified: 2023-03-03
tags:
  - attack.stealth
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - h^t^t^p
      - h"t"t"p
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
    type: derived