Windows Process Execution with cmd.exe Arguments Matching Koadic Parameters

title: Windows Process Execution with cmd.exe Arguments Matching Koadic Parameters
id: 9024d0c6-d1c3-46b9-8380-a9f3b8701353
status: test
description: This rule identifies Windows command interpreter processes launched with command-line arguments that include /q and /c along with chcp, while matching cmd.exe via image or OriginalFileName. Such parameter patterns are relevant because attackers often use cmd.exe to run staged payload logic and system command sequences during execution. The detection relies on process creation telemetry, specifically the image path/name and full command line provided at process start.
references:
  - https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/
  - https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js
  - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_koadic.yml
author: wagga, Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2020-01-12
modified: 2023-02-11
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cli:
    CommandLine|contains|all:
      - /q
      - /c
      - chcp
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 5cddf373-ef00-4112-ad72-960ac29bac34
    type: derived