Techniques
Sample rules
Windows For Loop Usage Within Cmd.exe To Execute Commands
- source: splunk
- technicques:
Description
The following analytic identifies the use of a for /f loop with the delims= option within cmd.exe, a technique commonly used to parse and extract data from the output of other commands.
Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Processes WHERE
Processes.parent_process="*for /f*"
Processes.parent_process="*delims=*"
NOT Processes.user="SYSTEM"
NOT Processes.user="*$"
NOT Processes.parent_process IN (
"*__VIARelease*",
"*:\\Program Files\\Microsoft SQL Server\\*",
"*^
| findstr *"
)
by Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id
Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id
Processes.process_integrity_level Processes.process_name
Processes.process_path Processes.user Processes.user_id
Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_for_loop_usage_within_cmd_exe_to_execute_commands_filter`