Windows Security EID 4697: cmd.exe Command Using obfuscated SET with -f, likely launching PowerShell via environment variables

Alerts on EID 4697 service installation command lines containing obfuscated cmd.exe SET patterns used to execute PowerShell via environment variables.

FreeUnreviewedSigmahighv1

windows-security-eid-4697-cmd-exe-command-using-obfuscated-set-with-f-likely-lau-dcf2db1f

title: "Windows Security EID 4697: cmd.exe Command Using obfuscated SET with -f, likely launching PowerShell via environment variables"
id: 9a4dd2d2-093a-4d38-b2be-ad3fbbb3c753
related:
  - id: 8ca7004b-e620-4ecb-870e-86129b5b8e75
    type: derived
  - id: dcf2db1f-f091-425b-a821-c05875b8925a
    type: derived
status: test
description: This rule flags Windows System Security Extension events (EID 4697) where the recorded service command line includes cmd.exe with an embedded SET operation and string formatting tokens (e.g., -f), consistent with obfuscated PowerShell execution using environment variables. Attackers often use environment-variable indirection and command-line obfuscation to evade script and command detection. Telemetry relies on Windows Security audit event 4697 fields, specifically ServiceFileName containing cmd.exe and substrings that indicate SET and formatting usage in the command line.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_var_services_security.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains|all:
      - cmd
      - '"set'
      - -f
    ServiceFileName|contains:
      - /c
      - /r
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows System Security Extension events (EID 4697) where the recorded service command line includes cmd.exe with an embedded SET operation and string formatting tokens (e.g., -f), consistent with obfuscated PowerShell execution using environment variables. Attackers often use environment-variable indirection and command-line obfuscation to evade script and command detection. Telemetry relies on Windows Security audit event 4697 fields, specifically ServiceFileName containing cmd.exe and substrings that indicate SET and formatting usage in the command line.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.