Processes Spawning cmd.exe
Hypothesis and description
The Windows Command Prompt (cmd.exe) is a utility that provides a command line interface to Windows operating systems. It provides the ability to run additional programs and also has several built-in commands such as dir, copy, mkdir, and type, as well as batch scripts (.bat). Typically, when a user runs a command prompt, the parent process is explorer.exe or another instance of the prompt. There may be automated programs, logon scripts, or administrative tools that launch instances of the command prompt in order to run scripts or other built-in commands. Spawning the process cmd.exe from certain parents may be more indicative of malice. For example, if Adobe Reader or Outlook launches a command shell, this may suggest that a malicious document has been loaded and should be investigated. Thus, by looking for abnormal parent processes of cmd.exe, it may be possible to detect adversaries.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- Process
- Submitted
- 2013-02-05
- Contributors
- MITRE
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1059 Command and Scripting InterpreterT1059.003 | Execution | Moderate |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
process = search Process:Create
cmd = filter process where (exe == "cmd.exe")
output cmdDNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*cmd\.exe.*)i limit 100LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image="*\cmd.exe"Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-DADynamic Analysis1 shared
- D3-EFAEmulated File Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
- D3-FEFile Encryption1 shared
- D3-FEVFile Eviction1 shared
- D3-FIMFile Integrity Monitoring1 shared
- D3-LFPLocal File Permissions1 shared