LoFP LoFP / legitimate use of cmd.exe with no arguments e.g. via system(\"\") in c to enable ansi escape codes

Techniques

Sample rules

Cmd.EXE Missing Space Characters Execution Anomaly

Description

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

Detection logic

condition: 1 of selection* and not 1 of filter_*
filter_fp:
- CommandLine|contains: AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules
- CommandLine|endswith: cmd.exe/c .
- CommandLine: cmd.exe /c
- CommandLine: cmd /c
filter_generic:
  CommandLine|contains:
  - 'cmd.exe /c '
  - 'cmd /c '
  - 'cmd.exe /k '
  - 'cmd /k '
  - 'cmd.exe /r '
  - 'cmd /r '
selection1:
  CommandLine|contains:
  - cmd.exe/c
  - \cmd/c
  - '"cmd/c'
  - cmd.exe/k
  - \cmd/k
  - '"cmd/k'
  - cmd.exe/r
  - \cmd/r
  - '"cmd/r'
selection2:
  CommandLine|contains:
  - /cwhoami
  - /cpowershell
  - /cschtasks
  - /cbitsadmin
  - /ccertutil
  - /kwhoami
  - /kpowershell
  - /kschtasks
  - /kbitsadmin
  - /kcertutil
selection3:
  CommandLine|contains:
  - cmd.exe /c
  - cmd /c
  - cmd.exe /k
  - cmd /k
  - cmd.exe /r
  - cmd /r