Detect Windows Command Shell in Microsoft Sentinel
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd.exe) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (.bat or .cmd) also provide the shell with a list of sequential commands to run. Adversaries may leverage cmd.exe to execute various commands and payloads, including single commands, interactive shells with C2 forwarding, and batch file execution.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.003 Windows Command Shell
- Canonical reference
- https://attack.mitre.org/techniques/T1059/003/
KQL Detection Query
let SuspiciousPatterns = dynamic([
"certutil -urlcache", "certutil -decode", "certutil -encode",
"bitsadmin /transfer", "bitsadmin /create",
"reg add", "reg delete", "reg save",
"schtasks /create", "schtasks /change",
"net user /add", "net localgroup administrators",
"wmic process call create", "wmic shadowcopy delete",
"vssadmin delete shadows", "bcdedit /set",
"icacls /grant", "takeown /f",
"echo | set /p=", "for /f",
"ping -n 1 -w", "> \\\\pipe\\"
]);
let SuspiciousParents = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "cmd.exe"
| where ProcessCommandLine has_any (SuspiciousPatterns) or InitiatingProcessFileName has_any (SuspiciousParents)
| extend CertutilAbuse = ProcessCommandLine has_any ("certutil -urlcache", "certutil -decode")
| extend ScheduledTask = ProcessCommandLine has "schtasks /create"
| extend UserCreation = ProcessCommandLine has "net user /add"
| extend ShadowDelete = ProcessCommandLine has_any ("vssadmin delete shadows", "wmic shadowcopy delete")
| extend SuspiciousParent = InitiatingProcessFileName has_any (SuspiciousParents)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
CertutilAbuse, ScheduledTask, UserCreation, ShadowDelete, SuspiciousParent
| sort by Timestamp descDetects suspicious Windows command shell (cmd.exe) execution patterns using MDE DeviceProcessEvents. Identifies certutil abuse for download/decode, scheduled task creation, user account manipulation, shadow copy deletion (ransomware indicator), and cmd.exe spawned by suspicious parents like Office apps, mshta, wscript, or rundll32.
Data Sources
Required Tables
False Positives & Tuning
- System administrators using cmd.exe with certutil for legitimate certificate operations
- Deployment scripts that create scheduled tasks for software installation or patching
- Backup solutions that interact with VSS shadow copies during backup operations
- IT automation tools using batch files for endpoint configuration
Other platforms for T1059.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil Download Cradle
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'certutil -urlcache'. Child process event for certutil.exe. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080.
- Test 2Shadow Copy Deletion via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'vssadmin'. Note: this test uses 'list' instead of 'delete' for safety. In real attacks, 'delete shadows /all /quiet' would be used.
- Test 3Scheduled Task Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe spawning schtasks.exe. Security Event ID 4698: Scheduled Task Created with task name 'df00tech-test'.
- Test 4Local Account Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with 'net user' in CommandLine. Security Event ID 4720: User Account Created. Security Event ID 4732: Member Added to Security-Enabled Local Group.
References (6)
- https://attack.mitre.org/techniques/T1059/003/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.003/T1059.003.md
- https://lolbas-project.github.io/
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh
Unlock Pro Content
Get the full detection package for T1059.003 including response playbook, investigation guide, and atomic red team tests.