Windows Process Creation: Obfuscated cmd Launcher Using PowerShell with STDIN Input

Detects obfuscated cmd executions that launch PowerShell and reference $input/noexit patterns for STDIN-based execution.

FreeUnreviewedSigmahighv1

windows-process-creation-obfuscated-cmd-launcher-using-powershell-with-stdin-inp-6c96fc76

title: "Windows Process Creation: Obfuscated cmd Launcher Using PowerShell with STDIN Input"
id: 871e3c2a-5f09-4dc9-b68c-f5a30de9bb26
status: test
description: This rule flags process executions where cmd is used with highly obfuscated casing and embeds PowerShell invocation that reads from STDIN (via $input) or uses the noexit option. Attackers can use this pattern to fetch and execute PowerShell content interactively and evade simple command-line matching. Telemetry relies on Windows process creation events with a command-line field that preserves the full launcher syntax and arguments.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_stdin.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2024-04-15
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+\"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6c96fc76-0eb1-11eb-adc1-0242ac120002
    type: derived

What it detects

This rule flags process executions where cmd is used with highly obfuscated casing and embeds PowerShell invocation that reads from STDIN (via $input) or uses the noexit option. Attackers can use this pattern to fetch and execute PowerShell content interactively and evade simple command-line matching. Telemetry relies on Windows process creation events with a command-line field that preserves the full launcher syntax and arguments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.