Cross-source coverage

T1059.003 / ATT&CK

Command and Scripting Interpreter: Windows Command Shell

143 rules · 140 families across 8 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Batch files (ex:.bat or.cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Adversaries may leverage cmd to execute various commands and payloads. Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.

Tactics: Execution
Platforms: Windows
Telemetry: WinEventLog:SecurityWinEventLog:SysmonEDR:scriptblock

How MITRE says to detect it DET0202

Behavioral Detection of Windows Command Shell Execution

Windows Analytic 0578

Detects interactive or scripted abuse of cmd.exe, batch files, or shell invocation chains. Focuses on parent-child relationships (e.g., cmd.exe launched from unusual parents), anomalous command-line parameters, and chaining with discovery, credential access, or lateral movement behaviors.

WinEventLog:Security EventCode=4688
WinEventLog:Sysmon EventCode=7
EDR:scriptblock Process Tree + Script Block Logging

View on attack.mitre.org ↗

SigmaHQ/sigma

46 rules

Detection	Severity	Format
Elise Backdoor Activity	Critical	Sigma
Rorschach Ransomware Execution Activity	Critical	Sigma
ZxShell Malware	Critical	Sigma
AWS EC2 Startup Shell Script Change	High	Sigma
Axios NPM Compromise Indicators - Windows	High	Sigma
Conhost.exe CommandLine Path Traversal	High	Sigma
DNS Query by Finger Utility	High	Sigma
Exploited CVE-2020-10189 Zoho ManageEngine	High	Sigma
Exploiting SetupComplete.cmd CVE-2019-1378	High	Sigma
HackTool - CrackMapExec Execution	High	Sigma

+ 36 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

39 rules

Detection	Severity	Format
Command and Scripting Interpreter via Windows Scripts	High	Elastic TOML
Microsoft Exchange Worker Spawning Suspicious Processes	High	Elastic TOML
Potential Command Shell via NetCat	High	Elastic TOML
Potential Execution via FileFix Phishing Attack	High	Elastic TOML
Potential Fake CAPTCHA Phishing Attack	High	Elastic TOML
Potential SAP NetWeaver Exploitation	High	Elastic TOML
Potential SharpRDP Behavior	High	Elastic TOML
Proxy Execution via Console Window Host	High	Elastic TOML
ScreenConnect Server Spawning Suspicious Processes	High	Elastic TOML
Suspicious Cmd Execution via WMI	High	Elastic TOML

+ 29 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

31 rules

Detection	Severity	Format
Attempt to establish VScode Remote Tunnel	Undefined	Elastic TOML
BCDEdit Safe Mode Command Execution	Undefined	Elastic TOML
Command and Scripting Interpreter from Suspicious Parent	Undefined	Elastic TOML
Command Shell Activity Started via RunDLL32	Undefined	Elastic TOML
Command Shell Execution from Untrusted Origin	Undefined	Elastic TOML
Curl HTTP Fetch Piped to Cmd or Node via Command Shell	Undefined	Elastic TOML
Embedded Executable via Windows Shortcut File	Undefined	Elastic TOML
Execution via SyncAppvPublishingServer	Undefined	Elastic TOML
Inhibit System Recovery via Obfuscated Commands	Undefined	Elastic TOML
Inhibit System Recovery via Windows Command Shell	Undefined	Elastic TOML

+ 21 more from elastic/protections-artifacts → showing the 10 highest-severity

splunk/security_content

15 rules

Detection	Severity	Format
CMD Carry Out String Command Parameter	Undefined	SPL
CMD Echo Pipe - Escalation	Undefined	SPL
CrushFTP Authentication Bypass Exploitation	Undefined	SPL
Detect Prohibited Applications Spawning cmd exe	Undefined	SPL
Detect Use of cmd exe to Launch Script Interpreters	Undefined	SPL
Ryuk Wake on LAN Command	Undefined	SPL
Windows Command Shell DCRat ForkBomb Payload	Undefined	SPL
Windows File Association Modification via Ftype	Undefined	SPL
Windows PowerShell FakeCAPTCHA Clipboard Execution	Undefined	SPL
Windows Powershell History File Deletion	Undefined	SPL

+ 5 more from splunk/security_content → showing the 10 highest-severity

Wazuh Core Ruleset

8 rules

Detection	Severity	Format
Detected a suspicious process launched with a jscript engine signature	High	Wazuh XML
Scripting interpreter spawned Windows command shell instance	Medium	Wazuh XML
A binary was started by a Windows cmd shell · win.eventdata.originalFileName = (?i)(SystemPropertiesAdvanced\|net)\.EXE	Low	Wazuh XML
A net.exe domain discovery command was executed	Low	Wazuh XML
Powershell process spawned Windows command shell instance	Low	Wazuh XML
Suspicious Windows cmd shell execution	Low	Wazuh XML
Windows backup and restore tool launched via with integrity level · win.eventdata.originalFileName = (?i)sdclt\.exe, win.eventdata.parentImage = (?i)(cmd\.exe\|powershell\.exe)	Low	Wazuh XML
Windows command prompt started by an abnormal process	Low	Wazuh XML

chronicle/detection-rules

2 rules

Detection	Severity	Format
fileless_attack_via_regsvr32exe	Undefined	YARA-L
possible_flash_0day_execute_embedded_in_word_document_sysmon	Undefined	YARA-L

Azure/Azure-Sentinel

1 rule

Detection	Severity	Format
Exchange Worker Process Making Remote Call	Medium	KQL

Bert-JanP/Hunting-Queries-Detection-Rules

1 rule

Detection	Severity	Format
Smoke Sandstorm - SnailResin and SlugResin Infection Detection	Undefined	KQL