Windows query.exe used to enumerate sessions and processes (possible data exfil staging)

Detects query.exe runs that request session and process output, matching patterns consistent with staged data collection.

FreeUnreviewedSigmamediumv1

windows-query-exe-used-to-enumerate-sessions-and-processes-possible-data-exfil-s-53ef0cef

title: Windows query.exe used to enumerate sessions and processes (possible data exfil staging)
id: f5758569-d8dc-4ec6-951c-e5eaeb1a7b76
status: test
description: This rule flags process executions of the Windows system binary query.exe when the command line contains output redirection patterns for sessions and processes ("session >" and "process >"). Enumerating these artifacts can support later collection or staging of sensitive host information for exfiltration. The detection relies on Windows process creation telemetry including the executable path and command-line contents.
references:
  - https://twitter.com/MichalKoczwara/status/1553634816016498688
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_query_session_exfil.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-01
modified: 2023-01-19
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: :\Windows\System32\query.exe
    CommandLine|contains:
      - session >
      - process >
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2
    type: derived

What it detects

This rule flags process executions of the Windows system binary query.exe when the command line contains output redirection patterns for sessions and processes ("session >" and "process >"). Enumerating these artifacts can support later collection or staging of sensitive host information for exfiltration. The detection relies on Windows process creation telemetry including the executable path and command-line contents.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.