Windows: Koadic Command Prompt Invocation with /q /c chcp

Flags cmd.exe executions with /q /c and chcp in the command line, matching Koadic-style command parameters.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: wagga, Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-01-12
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creation where the command interpreter (cmd.exe) is launched with specific arguments: /q, /c, and chcp. Attackers may use command execution parameters to run short, encoded or staged actions in a less visible way. The detection relies on process creation telemetry including the executable name and the full command line used to start cmd.exe.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange

Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked

Windows AppLocker Blocked Application, Script, MSI, or Packaged-App Execution

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Windows: Alert on Suspicious HH.EXE Process Execution

Suspicious Script Host Execution of Decoy-Named JavaScript Dropper (PS1Bot)

Suspicious Wscript Execution of JavaScript From AppData Local Temp via Process Creation (via process_creation)

Windows Process Tree for Axios npm Supply-Chain RAT Droppers (cscript, curl, PowerShell)

Windows Wscript/Cscript Executes Files with Uncommon Non-Script Extensions

Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths

Windows: Koadic Command Prompt Invocation with /q /c chcp

Pivot detection · T1059.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-with-cmd-exe-arguments-matching-koadic-parameters-5cddf373

title: "Windows: Koadic Command Prompt Invocation with /q /c chcp"
id: 9024d0c6-d1c3-46b9-8380-a9f3b8701353
status: test
description: "This rule identifies Windows process creation where the command interpreter (cmd.exe) is launched with specific arguments: /q, /c, and chcp. Attackers may use command execution parameters to run short, encoded or staged actions in a less visible way. The detection relies on process creation telemetry including the executable name and the full command line used to start cmd.exe."
references:
  - https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/
  - https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js
  - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_koadic.yml
author: wagga, Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2020-01-12
modified: 2023-02-11
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.005
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cli:
    CommandLine|contains|all:
      - /q
      - /c
      - chcp
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 5cddf373-ef00-4112-ad72-960ac29bac34
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL