Windows Process Creation Command-Line Indicator Matching 'uTYNkfKxHiZrx3KJ'
Triggers on Windows process creation events with command line containing 'uTYNkfKxHiZrx3KJ'.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-24
- Updated
- 2026-07-31
What it detects
This rule matches Windows process creation events where the command line contains the specific string ' uTYNkfKxHiZrx3KJ'. Command-line indicators like this can help identify suspicious or automated execution patterns even when full context is limited. It relies on process creation telemetry that includes the full command line for newly spawned processes.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/proc_creation_win_apt_diamond_sleet_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-detects-command-line-string-utynkfkxhizrx3kj-b5495d8d
title: Windows Process Creation Command-Line Indicator Matching 'uTYNkfKxHiZrx3KJ'
id: 130e1dd6-5c46-4014-8702-7ac8cd2c66a4
status: test
description: This rule matches Windows process creation events where the command line contains the specific string ' uTYNkfKxHiZrx3KJ'. Command-line indicators like this can help identify suspicious or automated execution patterns even when full context is limited. It relies on process creation telemetry that includes the full command line for newly spawned processes.
references:
- https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/proc_creation_win_apt_diamond_sleet_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: " uTYNkfKxHiZrx3KJ"
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: b5495d8d-24ad-4a44-8caf-ceae9a07a5c2
type: derived