Windows query.exe used to enumerate sessions and processes (possible data exfil staging)
Detects query.exe runs that request session and process output, matching patterns consistent with staged data collection.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-01
- Updated
- 2026-07-30
What it detects
This rule flags process executions of the Windows system binary query.exe when the command line contains output redirection patterns for sessions and processes ("session >" and "process >"). Enumerating these artifacts can support later collection or staging of sensitive host information for exfiltration. The detection relies on Windows process creation telemetry including the executable path and command-line contents.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-query-exe-used-to-enumerate-sessions-and-processes-possible-data-exfil-s-53ef0cef
title: Windows query.exe used to enumerate sessions and processes (possible data exfil staging)
id: f5758569-d8dc-4ec6-951c-e5eaeb1a7b76
status: test
description: This rule flags process executions of the Windows system binary query.exe when the command line contains output redirection patterns for sessions and processes ("session >" and "process >"). Enumerating these artifacts can support later collection or staging of sensitive host information for exfiltration. The detection relies on Windows process creation telemetry including the executable path and command-line contents.
references:
- https://twitter.com/MichalKoczwara/status/1553634816016498688
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_query_session_exfil.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-01
modified: 2023-01-19
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: :\Windows\System32\query.exe
CommandLine|contains:
- session >
- process >
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2
type: derived