Skip to content

Commit 092b852

Browse files
vl43denswachchhanda000nasbench
authored
Merge PR #5767 from @vl43den - Add Cmd Launched with Hidden Start Flags to Suspicious Targets
new: Cmd Launched with Hidden Start Flags to Suspicious Targets --------- Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com> Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
1 parent d5188c3 commit 092b852

File tree

5 files changed

+157
-0
lines changed

5 files changed

+157
-0
lines changed

‎.github/workflows/known-FPs.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,3 +74,4 @@ de587dce-915e-4218-aac4-835ca6af6f70;Potential Persistence Attempt Via Run Keys
7474
c7da8edc-49ae-45a2-9e61-9fd860e4e73d;PUA - Sysinternals Tools Execution - Registry;.*
7575
dcff7e85-d01f-4eb5-badd-84e2e6be8294;Windows Default Domain GPO Modification via GPME;Computer: WIN-FPV0DSIC9O6.sigma.fr
7676
416bc4a2-7217-4519-8dc7-c3271817f1d5;Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location;procexp64\.exe
77+
5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d;Cmd Launched with Hidden Start Flags to Suspicious Targets;xampp

‎regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d.json‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Sysmon",
10+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
11+
}
12+
},
13+
"EventID": 1,
14+
"Version": 5,
15+
"Level": 4,
16+
"Task": 1,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2025-12-04T07:01:44.982629Z"
22+
}
23+
},
24+
"EventRecordID": 27923,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 3116,
29+
"ThreadID": 1656
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-Sysmon/Operational",
33+
"Computer": "swachchhanda",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"RuleName": "-",
42+
"UtcTime": "2025-12-04 07:01:44.963",
43+
"ProcessGuid": "0197231E-31D8-6931-7209-000000000900",
44+
"ProcessId": 13752,
45+
"Image": "C:\\Windows\\System32\\cmd.exe",
46+
"FileVersion": "10.0.26100.2454 (WinBuild.160101.0800)",
47+
"Description": "Windows Command Processor",
48+
"Product": "Microsoft® Windows® Operating System",
49+
"Company": "Microsoft Corporation",
50+
"OriginalFileName": "Cmd.Exe",
51+
"CommandLine": "\"C:\\WINDOWS\\system32\\cmd.exe\" /c \"start /b /min C:\\Users\\xodih\\Music\\random.vbs\"",
52+
"CurrentDirectory": "C:\\WINDOWS\\system32\\",
53+
"User": "swachchhanda\\xodih",
54+
"LogonGuid": "0197231E-BBFB-692F-3C8C-050000000000",
55+
"LogonId": "0x58c3c",
56+
"TerminalSessionId": 1,
57+
"IntegrityLevel": "Medium",
58+
"Hashes": "MD5=352B525E9C26CB92693899528FE007C2,SHA256=1F1D918EC49E0B7C59B704FF412E1A6E224DA81C08CDA657E1CB482ABAAC146C,IMPHASH=94F3EFC2DF40ECD7229B904540DD83CF",
59+
"ParentProcessGuid": "0197231E-BBFF-692F-8200-000000000900",
60+
"ParentProcessId": 5200,
61+
"ParentImage": "C:\\Windows\\explorer.exe",
62+
"ParentCommandLine": "C:\\WINDOWS\\Explorer.EXE",
63+
"ParentUser": "swachchhanda\\xodih"
64+
}
65+
}
66+
}

‎regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: d813db34-f7f0-4713-a419-b491701aa1d1
2+
description: N/A
3+
date: 2025-12-04
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d
7+
title: Cmd Launched with Hidden Start Flags to Suspicious Targets
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d.evtx

‎rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
title: Cmd Launched with Hidden Start Flags to Suspicious Targets
2+
id: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d
3+
status: experimental
4+
description: |
5+
Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags.
6+
To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories.
7+
This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.
8+
references:
9+
- https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous
10+
- https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
11+
- https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one
12+
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start
13+
tags:
14+
- attack.defense-evasion
15+
- attack.t1564.003
16+
author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)
17+
date: 2026-01-24
18+
logsource:
19+
category: process_creation
20+
product: windows
21+
detection:
22+
selection_cmd_img:
23+
- Image|endswith: '\cmd.exe'
24+
- OriginalFileName: 'Cmd.Exe'
25+
selection_cmd_hidden_start_1:
26+
CommandLine|contains|windash:
27+
- 'start '
28+
- 'start/b'
29+
- 'start/min'
30+
selection_cmd_hidden_start_2:
31+
CommandLine|contains|windash:
32+
- '/b '
33+
- '/b"'
34+
- '/min '
35+
- '/min"'
36+
selection_cli_uncommon_location:
37+
CommandLine|contains:
38+
- ':\Perflogs\'
39+
- ':\Temp\'
40+
- ':\Users\Default\'
41+
- ':\Windows\Temp\'
42+
- '\AppData\Roaming\'
43+
- '\Contacts\'
44+
- '\Documents\'
45+
- '\Downloads\'
46+
- '\Favorites\'
47+
- '\Favourites\'
48+
- '\inetpub\'
49+
- '\Music\'
50+
- '\Photos\'
51+
- '\Temporary Internet\'
52+
- '\Users\Public\'
53+
- '\Videos\'
54+
selection_cli_susp_extension:
55+
CommandLine|contains:
56+
- '.bat'
57+
- '.cmd'
58+
- '.cpl'
59+
- '.hta'
60+
- '.js'
61+
- '.ps1'
62+
- '.scr'
63+
- '.vbe'
64+
- '.vbs'
65+
selection_cli_susp_pattern:
66+
CommandLine|contains:
67+
- ' -nop '
68+
- ' -sta '
69+
- '.downloadfile(' # PowerShell download command
70+
- '.downloadstring(' # PowerShell download command
71+
- '-noni '
72+
- '-w hidden '
73+
condition: all of selection_cmd_* and 1 of selection_cli_*
74+
falsepositives:
75+
- Legitimate administrative scripts running from temporary folders.
76+
- Niche software updaters utilizing hidden batch files in ProgramData.
77+
level: medium # Can be increased after an initial baseline and tuning
78+
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml

0 commit comments

Comments
 (0)