Windows: Koadic Command Prompt Invocation with /q /c chcp
Flags cmd.exe executions with /q /c and chcp in the command line, matching Koadic-style command parameters.
- Product
- windows
- Category
- process_creation
- Author
- wagga, Jonhnathan Ribeiro, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-01-12
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation where the command interpreter (cmd.exe) is launched with specific arguments: /q, /c, and chcp. Attackers may use command execution parameters to run short, encoded or staged actions in a less visible way. The detection relies on process creation telemetry including the executable name and the full command line used to start cmd.exe.
Reporting behind it
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/
- github.comhttps://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js
- blog.f-secure.comhttps://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_koadic.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Koadic Command Prompt Invocation with /q /c chcp"
id: 9024d0c6-d1c3-46b9-8380-a9f3b8701353
status: test
description: "This rule identifies Windows process creation where the command interpreter (cmd.exe) is launched with specific arguments: /q, /c, and chcp. Attackers may use command execution parameters to run short, encoded or staged actions in a less visible way. The detection relies on process creation telemetry including the executable name and the full command line used to start cmd.exe."
references:
- https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/
- https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js
- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_koadic.yml
author: wagga, Jonhnathan Ribeiro, oscd.community, Huntrule Team
date: 2020-01-12
modified: 2023-02-11
tags:
- attack.execution
- attack.t1059.003
- attack.t1059.005
- attack.t1059.007
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \cmd.exe
- OriginalFileName: Cmd.Exe
selection_cli:
CommandLine|contains|all:
- /q
- /c
- chcp
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 5cddf373-ef00-4112-ad72-960ac29bac34
type: derived