Windows Process Creation: Suspicious calc.exe Command Line or Non-System Path

Alerts on suspicious calc.exe launches via command-line parameters or execution from non-standard Windows directories.

FreeUnreviewedSigmahighv1

windows-process-creation-suspicious-calc-exe-command-line-or-non-system-path-737e618a

title: "Windows Process Creation: Suspicious calc.exe Command Line or Non-System Path"
id: 7cfe42ab-dbaa-4ab5-a52b-528d3ac20947
status: test
description: This rule flags process creation events where calc.exe is launched with command-line arguments (matching “\calc.exe ”) or where calc.exe is run from a directory other than typical Windows system locations. Attackers and testing tools may use calculator to blend in as a benign executable while executing or probing behavior through command-line parameters or unexpected paths. The detection relies on Windows process creation telemetry, specifically the Image path and CommandLine contents.
references:
  - https://twitter.com/ItsReallyNick/status/1094080242686312448
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-02-09
modified: 2023-11-09
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains: "\\calc.exe "
  selection_2:
    Image|endswith: \calc.exe
  filter_main_known_locations:
    Image|contains:
      - :\Windows\System32\
      - :\Windows\SysWOW64\
      - :\Windows\WinSxS\
  condition: selection_1 or ( selection_2 and not filter_main_known_locations )
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 737e618a-a410-49b5-bec3-9e55ff7fbc15
    type: derived

What it detects

This rule flags process creation events where calc.exe is launched with command-line arguments (matching “\calc.exe ”) or where calc.exe is run from a directory other than typical Windows system locations. Attackers and testing tools may use calculator to blend in as a benign executable while executing or probing behavior through command-line parameters or unexpected paths. The detection relies on Windows process creation telemetry, specifically the Image path and CommandLine contents.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.