Cmd Launched with Hidden Start Flags to Suspicious Targets

Severity: medium
Author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)
Source: upstream

Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories. This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1564.003` Hide Artifacts: Hidden Window

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_cmd_img`

or:
Image|endswith: '\cmd.exe'
OriginalFileName: Cmd.Exe

Stage 2: `all of selection_cmd_hidden_start_1`

or:
CommandLine|contains: 'start '
CommandLine|contains: 'start/b'
CommandLine|contains: 'start/min'

Stage 3: `all of selection_cmd_hidden_start_2`

or:
CommandLine|contains: '/b '
CommandLine|contains: '/b"'
CommandLine|contains: '/min '
CommandLine|contains: '/min"'

Stage 4: `1 of selection_cli_uncommon_location`

or:
CommandLine|contains: ':\Perflogs\'
CommandLine|contains: ':\Temp\'
CommandLine|contains: ':\Users\Default\'
CommandLine|contains: ':\Windows\Temp\'
CommandLine|contains: '\AppData\Roaming\'
CommandLine|contains: '\Contacts\'
CommandLine|contains: '\Documents\'
CommandLine|contains: '\Downloads\'
CommandLine|contains: '\Favorites\'
CommandLine|contains: '\Favourites\'
CommandLine|contains: '\Music\'
CommandLine|contains: '\Photos\'
CommandLine|contains: '\Temporary Internet\'
CommandLine|contains: '\Users\Public\'
CommandLine|contains: '\Videos\'
CommandLine|contains: '\inetpub\'

Stage 5: `1 of selection_cli_susp_extension`

or:
CommandLine|contains: .bat
CommandLine|contains: .cmd
CommandLine|contains: .cpl
CommandLine|contains: .hta
CommandLine|contains: .js
CommandLine|contains: .ps1
CommandLine|contains: .scr
CommandLine|contains: .vbe
CommandLine|contains: .vbs

Stage 6: `1 of selection_cli_susp_pattern`

or:
CommandLine|contains: ' -nop '
CommandLine|contains: ' -sta '
CommandLine|contains: '-noni '
CommandLine|contains: '-w hidden '
CommandLine|contains: '.downloadfile('
CommandLine|contains: '.downloadstring('

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`-nop` `-sta` `-noni` `-w hidden` `.bat` corpus 8 (sigma 8) `.cmd` corpus 5 (sigma 5) `.cpl` corpus 4 (sigma 4) `.downloadfile(` corpus 3 (sigma 3) `.downloadstring(` corpus 3 (sigma 3) `.hta` corpus 5 (sigma 5) `.js` corpus 6 (sigma 6) `.ps1` corpus 3 (sigma 3) `.scr` corpus 5 (sigma 5) `.vbe` corpus 4 (sigma 4) `.vbs` corpus 5 (sigma 5) `/b` `/b"` `/min` `/min"` `:\Perflogs\` corpus 4 (sigma 4) `:\Temp\` corpus 14 (sigma 14) `:\Users\Default\` corpus 3 (sigma 3) `:\Windows\Temp\` corpus 15 (sigma 15) `\AppData\Roaming\` corpus 10 (sigma 10) `\Contacts\` corpus 6 (sigma 6) `\Documents\` `\Downloads\` corpus 12 (sigma 12) `\Favorites\` corpus 6 (sigma 6) `\Favourites\` corpus 6 (sigma 6) `\Music\` corpus 2 (sigma 2) `\Photos\` `\Temporary Internet\` `\Users\Public\` corpus 17 (sigma 17) `\Videos\` corpus 2 (sigma 2) `\inetpub\` `start` `start/b` `start/min`
`Image`	ends_with	`\cmd.exe` corpus 92 (sigma 92)
`OriginalFileName`	eq	`Cmd.Exe` corpus 32 (sigma 30, splunk 2)

Cmd Launched with Hidden Start Flags to Suspicious Targets

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_cmd_img

Stage 2: all of selection_cmd_hidden_start_1

Stage 3: all of selection_cmd_hidden_start_2

Stage 4: 1 of selection_cli_uncommon_location

Stage 5: 1 of selection_cli_susp_extension