Detect Windows Command Shell in Elastic Security
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd.exe) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (.bat or .cmd) also provide the shell with a list of sequential commands to run. Adversaries may leverage cmd.exe to execute various commands and payloads, including single commands, interactive shells with C2 forwarding, and batch file execution.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.003 Windows Command Shell
- Canonical reference
- https://attack.mitre.org/techniques/T1059/003/
Elastic Detection Query
process where event.type == "start" and
process.name : "cmd.exe" and
(
process.command_line : (
"*certutil*-urlcache*", "*certutil*-decode*", "*certutil*-encode*",
"*bitsadmin*/transfer*", "*bitsadmin*/create*",
"*reg*add*", "*reg*delete*", "*reg*save*",
"*schtasks*/create*", "*schtasks*/change*",
"*net*user*/add*", "*net*localgroup*administrators*",
"*wmic*process*call*create*", "*wmic*shadowcopy*delete*",
"*vssadmin*delete*shadows*", "*bcdedit*/set*",
"*icacls*/grant*", "*takeown*/f*"
) or
process.parent.name : (
"winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
"mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe"
)
)
| eval certutil_abuse = process.command_line like~ "*certutil*-urlcache*" or process.command_line like~ "*certutil*-decode*"
| eval shadow_delete = process.command_line like~ "*vssadmin*delete*shadows*" or process.command_line like~ "*wmic*shadowcopy*delete*"
| eval sched_task = process.command_line like~ "*schtasks*/create*"
| eval user_creation = process.command_line like~ "*net*user*/add*"
| eval suspicious_parent = process.parent.name in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe")Detects suspicious cmd.exe execution using ECS fields from Elastic Endpoint or Winlogbeat with Sysmon. Flags certutil abuse, shadow copy deletion, scheduled task creation, user account manipulation, and cmd.exe spawned from Office or script-interpreter parents — all key indicators of T1059.003 abuse.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators running certutil.exe for legitimate SSL/TLS certificate import or export operations via cmd.exe wrappers
- Software deployment tools (SCCM, PDQ Deploy, Ansible) executing cmd.exe batch scripts that invoke schtasks, net user, or reg commands during provisioning
- Security and vulnerability scanners (Tenable, Rapid7) spawning cmd.exe sub-processes with administrative commands as part of credentialed audits
- Developer workstations running build scripts (MSBuild, Makefile targets) that invoke cmd.exe with reg or icacls to set permissions on build artifacts
Other platforms for T1059.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil Download Cradle
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'certutil -urlcache'. Child process event for certutil.exe. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080.
- Test 2Shadow Copy Deletion via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'vssadmin'. Note: this test uses 'list' instead of 'delete' for safety. In real attacks, 'delete shadows /all /quiet' would be used.
- Test 3Scheduled Task Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe spawning schtasks.exe. Security Event ID 4698: Scheduled Task Created with task name 'df00tech-test'.
- Test 4Local Account Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with 'net user' in CommandLine. Security Event ID 4720: User Account Created. Security Event ID 4732: Member Added to Security-Enabled Local Group.
References (6)
- https://attack.mitre.org/techniques/T1059/003/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.003/T1059.003.md
- https://lolbas-project.github.io/
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh
Unlock Pro Content
Get the full detection package for T1059.003 including response playbook, investigation guide, and atomic red team tests.