Windows Process Creation with Specific Suspicious Command-Line String

Alerts on Windows process creations whose command line contains a specific suspicious substring.

FreeUnreviewedSigmahighv1

windows-process-creation-with-specific-suspicious-command-line-string-2e7bbd54

title: Windows Process Creation with Specific Suspicious Command-Line String
id: ed72ac33-6c2b-4986-8c57-4cef5a287c60
status: test
description: This rule flags Windows process creation events when the process command line contains the specific string pattern 'QP''s\*(58vaP!tF4'. Attackers may use distinct or obfuscated command-line parameters during execution, and matching exact suspicious substrings can surface this activity. The detection relies on process creation telemetry that includes the full command line.
references:
  - https://twitter.com/MsftSecIntel/status/1737895710169628824
  - https://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Peach-Sandstorm/proc_creation_win_apt_peach_sandstorm_indicators.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2024-01-15
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: QP's\*(58vaP!tF4
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 2e7bbd54-2f26-476e-b4a1-ba5f1a012614
    type: derived

What it detects

This rule flags Windows process creation events when the process command line contains the specific string pattern 'QP''s\*(58vaP!tF4'. Attackers may use distinct or obfuscated command-line parameters during execution, and matching exact suspicious substrings can surface this activity. The detection relies on process creation telemetry that includes the full command line.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.