Windows Process Creation: Suspected Path Traversal in cmd.exe Command Lines

Alerts on Windows cmd.exe executions with "../.." path traversal indicators in parent/child command lines.

FreeUnreviewedSigmahighv1

windows-process-creation-suspected-path-traversal-in-cmd-exe-command-lines-087790e3

title: "Windows Process Creation: Suspected Path Traversal in cmd.exe Command Lines"
id: 6a344de0-1ff8-4b41-b21d-f52c8e2fa2d7
status: test
description: This rule flags process creation events involving cmd.exe where the parent or child command line contains path traversal patterns ("/../../") alongside cmd.exe execution. Such behavior can indicate command/argument confusion or path manipulation intended to change what resources are referenced or executed. It relies on process creation telemetry including ParentImage/Image and the full ParentCommandLine and CommandLine contents, with an exclusion for a specific Java-related path pattern to reduce known false positives.
references:
  - https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/
  - https://twitter.com/Oddvarmoe/status/1270633613449723905
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_path_traversal.yml
author: xknow @xknow_infosec, Tim Shelton, Huntrule Team
date: 2020-06-11
modified: 2023-03-06
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - ParentImage|endswith: \cmd.exe
    - Image|endswith: \cmd.exe
    - OriginalFileName: cmd.exe
  selection_flags:
    - ParentCommandLine|contains:
        - /c
        - /k
        - /r
    - CommandLine|contains:
        - /c
        - /k
        - /r
  selection_path_traversal:
    - ParentCommandLine: /../../
    - CommandLine|contains: /../../
  filter_java:
    CommandLine|contains: \Tasktop\keycloak\bin\/../../jre\bin\java
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Java tools are known to produce false-positive when loading libraries
level: high
license: DRL-1.1
related:
  - id: 087790e3-3287-436c-bccf-cbd0184a7db1
    type: derived

What it detects

This rule flags process creation events involving cmd.exe where the parent or child command line contains path traversal patterns ("/../../") alongside cmd.exe execution. Such behavior can indicate command/argument confusion or path manipulation intended to change what resources are referenced or executed. It relies on process creation telemetry including ParentImage/Image and the full ParentCommandLine and CommandLine contents, with an exclusion for a specific Java-related path pattern to reduce known false positives.

Known false positives

Java tools are known to produce false-positive when loading libraries

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.