Windows Common Abused Cmd Shell Risk Behavior

Description

| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
  WHERE source IN ("*Windows Cmdline Tool Execution From Non-Shell Process*", "*Windows System Network Config Discovery Display DNS*", "*Local Account Discovery With Wmic*", "*Windows Group Discovery Via Net*", "*Windows Create Local Administrator Account Via Net*", "*Windows User Discovery Via Net*", "*Icacls Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery Using ldap Nslookup*", "*Windows System Shutdown CommandLine*")
  BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
| `drop_dm_object_name(All_Risk)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| where source_count >= 4
| `windows_common_abused_cmd_shell_risk_behavior_filter`

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

• correlates · Splunk risk datamodel Azorult
  56 rules in this analytic story
• correlates · Splunk risk datamodel CISA AA23-347A
  99 rules in this analytic story
• correlates · Splunk risk datamodel DarkCrystal RAT
  21 rules in this analytic story
• correlates · Splunk risk datamodel Disabling Security Tools
  • Suspicious Reg exe Process
  • Unload Sysmon Filter Driver
  • Windows Attempt To Stop Security Service
  • Windows Filtering Platform Policy Added to Block EDR Process
• correlates · Splunk risk datamodel FIN7
  • Check Elevated CMD using whoami
  • Jscript Execution Using Cscript App
  • MS Scripting Process Loading Ldap Module
  • MS Scripting Process Loading WMI Module
  • Non Chrome Process Accessing Chrome Default Dir
  • Non Firefox Process Access Firefox Profile Dir
  • Vbscript Execution Using Wscript App
  • Windows Cmdline Tool Execution From Non-Shell Process
  • Windows Office Product Dropped Uncommon File
  • Windows Office Product Spawned Uncommon Process
  • Wscript Or Cscript Suspicious Child Process
  • XSL Script Execution With WMIC
• correlates · Splunk risk datamodel Microsoft WSUS CVE-2025-59287
  • Cisco NVM - Curl Execution With Insecure Flags
  • Malicious PowerShell Process - Encoded Command
  • Possible Lateral Movement PowerShell Spawn
  • PowerShell 4104 Hunting
  • PowerShell Domain Enumeration
  • Powershell Fileless Script Contains Base64 Encoded Content
  • Web or Application Server Spawning a Shell
  • Windows Curl Upload to Remote Destination
  • Windows Exfiltration Over C2 Via Invoke RestMethod
  • Windows File Download Via PowerShell
  • Windows Group Discovery Via Net
  • Windows Sensitive Group Discovery With Net
  • Windows Suspicious Child Process Spawned From WebServer
  • Windows WSUS Spawning Shell
  • WinRM Spawning a Process
• correlates · Splunk risk datamodel Netsh Abuse
  ⚠ No indexed rule declares this group, so this rule never matches.
• correlates · Splunk risk datamodel Qakbot
  52 rules in this analytic story
• correlates · Splunk risk datamodel Sandworm Tools
  • Detect Mimikatz With PowerShell Script Block Logging
  • Detect PsExec With accepteula Flag
  • Detect Renamed PSExec
  • Icacls Deny Command
  • Linux Iptables Firewall Modification
  • Linux Kworker Process In Writable Process Path
  • Malicious PowerShell Process - Encoded Command
  • Mimikatz PassTheTicket CommandLine Parameters
  • Permission Modification using Takeown App
  • Scheduled Task Deleted Or Created via CMD
  • Suspicious Copy on System32
  • Windows DNS Gather Network Info
  • Windows High File Deletion Frequency
  • Windows Mimikatz Binary Execution
  • Windows Mimikatz Crypto Export File Extensions
  • Windows PUA Named Pipe
  • Windows Suspicious File in EFI Volume
  • Windows System Shutdown CommandLine
  • Windows User Discovery Via Net
  • WinEvent Windows Task Scheduler Event Action Started
• correlates · Splunk risk datamodel Volt Typhoon
  45 rules in this analytic story
• correlates · Splunk risk datamodel Windows Defense Evasion Tactics
  93 rules in this analytic story
• correlates · Splunk risk datamodel Windows Post-Exploitation
  32 rules in this analytic story

Implementation guide

Known false positives

• False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers.

Analyst notes