Windows Process Creation: CommandLine ends with '.exe Platypus' Indicator

title: "Windows Process Creation: CommandLine ends with '.exe Platypus' Indicator"
id: 9b8b7c97-7487-4099-b353-aaa8c5ecffad
status: test
description: This rule flags Windows process creation events where the command line ends with the specific string '.exe Platypus'. Attackers may use tailored command-line arguments to start malicious components or control execution paths for persistence, stealth, or privilege escalation. The detection relies on process_creation telemetry that includes the full command line for the spawned process.
references:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Small-Sieve/proc_creation_win_malware_small_sieve_cli_arg.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-19
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|endswith: .exe Platypus
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 21117127-21c8-437a-ae03-4b51e5a8a088
    type: derived