Detect Windows Command Shell in Splunk
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd.exe) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (.bat or .cmd) also provide the shell with a list of sequential commands to run. Adversaries may leverage cmd.exe to execute various commands and payloads, including single commands, interactive shells with C2 forwarding, and batch file execution.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.003 Windows Command Shell
- Canonical reference
- https://attack.mitre.org/techniques/T1059/003/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image="*\\cmd.exe"
| eval CommandLine=lower(CommandLine)
| eval CertutilAbuse=if(match(CommandLine, "certutil\s+(-urlcache|-decode|-encode)"), 1, 0)
| eval ScheduledTask=if(match(CommandLine, "schtasks\s+/create"), 1, 0)
| eval UserCreation=if(match(CommandLine, "net\s+user\s+.*\s+/add"), 1, 0)
| eval ShadowDelete=if(match(CommandLine, "(vssadmin\s+delete\s+shadows|wmic\s+shadowcopy\s+delete)"), 1, 0)
| eval BCDEdit=if(match(CommandLine, "bcdedit\s+/set"), 1, 0)
| eval SuspiciousParent=if(match(ParentImage, "(winword|excel|powerpnt|outlook|mshta|wscript|cscript|rundll32|regsvr32)\.exe$"), 1, 0)
| eval SuspicionScore=CertutilAbuse + ScheduledTask + UserCreation + ShadowDelete + BCDEdit + SuspiciousParent
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, CertutilAbuse, ScheduledTask, UserCreation, ShadowDelete, BCDEdit, SuspiciousParent, SuspicionScore
| sort - _timeDetects suspicious cmd.exe execution using Sysmon Event ID 1. Evaluates commands for certutil abuse, scheduled task creation, user manipulation, shadow copy deletion, BCDEdit modification, and suspicious parent processes. Assigns a cumulative suspicion score for analyst prioritization.
Data Sources
Required Sourcetypes
False Positives & Tuning
- System administrators using cmd.exe with certutil for legitimate certificate operations
- Deployment scripts that create scheduled tasks for software installation or patching
- Backup solutions that interact with VSS shadow copies during backup operations
- IT automation tools using batch files for endpoint configuration
Other platforms for T1059.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil Download Cradle
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'certutil -urlcache'. Child process event for certutil.exe. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080.
- Test 2Shadow Copy Deletion via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'vssadmin'. Note: this test uses 'list' instead of 'delete' for safety. In real attacks, 'delete shadows /all /quiet' would be used.
- Test 3Scheduled Task Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe spawning schtasks.exe. Security Event ID 4698: Scheduled Task Created with task name 'df00tech-test'.
- Test 4Local Account Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with 'net user' in CommandLine. Security Event ID 4720: User Account Created. Security Event ID 4732: Member Added to Security-Enabled Local Group.
References (6)
- https://attack.mitre.org/techniques/T1059/003/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.003/T1059.003.md
- https://lolbas-project.github.io/
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh
Unlock Pro Content
Get the full detection package for T1059.003 including response playbook, investigation guide, and atomic red team tests.