AnomalyTTPCAR-2014-11-002

Outlier Parents of Cmd

Hypothesis and description

Many programs create command prompts as part of their normal operation including malware used by attackers. This analytic attempts to identify suspicious programs spawning cmd.exe by looking for programs that do not normally create cmd.exe.

While this analytic does not take the user into account, doing so could generate further interesting results.

It is very common for some programs to spawn cmd.exe as a subprocess, for example to run batch files or windows commands. However many process don’t routinely launch a command prompt - for example Microsoft Outlook. A command prompt being launched from a process that normally doesn’t launch command prompts could be the result of malicious code being injected into that process, or of an attacker replacing a legitimate program with a malicious one.

### Output Description

The time and host the new process was started as well as its parent

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2014-11-06
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1059 Command and Scripting InterpreterT1059.003	Execution	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1059Command and Scripting Interpreter
.003 Windows Command Shell

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-PLA Process Lineage Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

Create a baseline of parents of cmd.exe seen over the last 30 days and a list of parents of cmd.exe seen today. Remove parents in the baseline from parents seen today, leaving a list of new parents.

processes = search Process:Create
cmd = filter processes where (exe == "cmd.exe")
cmd = from cmd select parent_exe
historic_cmd = filter cmd (where timestamp < now - 1 day AND timestamp > now - 1 day)
current_cmd = filter cmd (where timestamp >= now - 1 day)
new_cmd = historic_cmd - current_cmd
output new_cmd

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

3 more in the full list

View CAR-2014-11-002 on car.mitre.org