Detect Windows Command Shell in CrowdStrike LogScale
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd.exe) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (.bat or .cmd) also provide the shell with a list of sequential commands to run. Adversaries may leverage cmd.exe to execute various commands and payloads, including single commands, interactive shells with C2 forwarding, and batch file execution.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.003 Windows Command Shell
- Canonical reference
- https://attack.mitre.org/techniques/T1059/003/
LogScale Detection Query
#event_simpleName = ProcessRollup2
| ImageFileName = /\\cmd\.exe$/i
| CommandLine != null
| eval CertutilAbuse = if(CommandLine = /(?i)certutil\s+(-urlcache|-decode|-encode)/, "1", "0")
| eval ScheduledTask = if(CommandLine = /(?i)schtasks\s+(\/create|\/change)/, "1", "0")
| eval UserCreation = if(CommandLine = /(?i)(net\s+user\s+.+\/add|net\s+localgroup\s+administrators)/, "1", "0")
| eval ShadowDelete = if(CommandLine = /(?i)(vssadmin\s+delete\s+shadows|wmic\s+shadowcopy\s+delete)/, "1", "0")
| eval BCDEdit = if(CommandLine = /(?i)bcdedit\s+\/set/, "1", "0")
| eval BitsAdminAbuse = if(CommandLine = /(?i)bitsadmin\s+(\/transfer|\/create)/, "1", "0")
| eval SuspiciousParent = if(ParentBaseFileName = /(?i)(winword|excel|powerpnt|outlook|mshta|wscript|cscript|rundll32|regsvr32)\.exe$/, "1", "0")
| eval SuspicionScore = toint(CertutilAbuse) + toint(ScheduledTask) + toint(UserCreation) + toint(ShadowDelete) + toint(BCDEdit) + toint(BitsAdminAbuse) + toint(SuspiciousParent)
| SuspicionScore > 0
| eval Severity = case(
SuspicionScore >= 4, "Critical",
SuspicionScore >= 2, "High",
SuspicionScore >= 1, "Medium"
)
| table([@timestamp, ComputerName, UserName, CommandLine, ParentBaseFileName, CertutilAbuse, ScheduledTask, UserCreation, ShadowDelete, BCDEdit, BitsAdminAbuse, SuspiciousParent, SuspicionScore, Severity])
| sort(field=@timestamp, order=desc)CrowdStrike Falcon LogScale (CQL) query detecting T1059.003 Windows Command Shell abuse using ProcessRollup2 events from the Falcon sensor. Evaluates cmd.exe command lines against six abuse pattern categories plus suspicious parent process detection, assigns a numeric suspicion score, and classifies event severity. Falcon sensor telemetry provides richer context than Windows event logs alone.
Data Sources
Required Tables
False Positives & Tuning
- Falcon sensor updates or CrowdStrike remediation scripts that invoke cmd.exe with icacls or reg commands to repair quarantined file permissions or registry keys
- RMM tools (ConnectWise, NinjaRMM, Datto) executing remote PowerShell-to-cmd.exe call chains for patch deployment, software installation, or device configuration changes
- SQL Server or IIS maintenance tasks using agent jobs that shell out to cmd.exe with schtasks or net commands to manage service accounts or scheduled jobs
Other platforms for T1059.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil Download Cradle
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'certutil -urlcache'. Child process event for certutil.exe. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080.
- Test 2Shadow Copy Deletion via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'vssadmin'. Note: this test uses 'list' instead of 'delete' for safety. In real attacks, 'delete shadows /all /quiet' would be used.
- Test 3Scheduled Task Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe spawning schtasks.exe. Security Event ID 4698: Scheduled Task Created with task name 'df00tech-test'.
- Test 4Local Account Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with 'net user' in CommandLine. Security Event ID 4720: User Account Created. Security Event ID 4732: Member Added to Security-Enabled Local Group.
References (6)
- https://attack.mitre.org/techniques/T1059/003/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.003/T1059.003.md
- https://lolbas-project.github.io/
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh
Unlock Pro Content
Get the full detection package for T1059.003 including response playbook, investigation guide, and atomic red team tests.