LoFP LoFP / during anaconda update the 'conda.exe' process will eventually execution the 'chcp' command.

Techniques

Sample rules

Console CodePage Lookup Via CHCP

Description

Detects use of chcp to look up the system locale value as part of host discovery

Detection logic

condition: selection
selection:
  CommandLine|endswith:
  - chcp
  - 'chcp '
  - 'chcp  '
  Image|endswith: \chcp.com
  ParentCommandLine|contains|windash:
  - ' -c '
  - ' -r '
  - ' -k '
  ParentImage|endswith: \cmd.exe