Detect Windows Command Shell in Sumo Logic CSE
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd.exe) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH. Batch files (.bat or .cmd) also provide the shell with a list of sequential commands to run. Adversaries may leverage cmd.exe to execute various commands and payloads, including single commands, interactive shells with C2 forwarding, and batch file execution.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.003 Windows Command Shell
- Canonical reference
- https://attack.mitre.org/techniques/T1059/003/
Sumo Detection Query
_sourceCategory=*windows*sysmon* OR _sourceCategory=*wineventlog*
| where EventCode=1 OR EventID=1
| parse regex field=_raw "(?i)Image(?:FileName)?[:\s]+(?<Image>[^\r\n]+)" nodrop
| parse regex field=_raw "(?i)CommandLine[:\s]+(?<CommandLine>[^\r\n]+)" nodrop
| parse regex field=_raw "(?i)ParentImage[:\s]+(?<ParentImage>[^\r\n]+)" nodrop
| parse regex field=_raw "(?i)User[:\s]+(?<User>[^\r\n]+)" nodrop
| parse regex field=_raw "(?i)(?:Computer|Hostname)[:\s]+(?<Computer>[^\r\n]+)" nodrop
| where Image matches "*\\cmd.exe"
| toLowerCase CommandLine as CommandLineLower
| eval CertutilAbuse = if(CommandLineLower matches "*certutil*-urlcache*" OR CommandLineLower matches "*certutil*-decode*" OR CommandLineLower matches "*certutil*-encode*", 1, 0)
| eval ScheduledTask = if(CommandLineLower matches "*schtasks*/create*" OR CommandLineLower matches "*schtasks*/change*", 1, 0)
| eval UserCreation = if(CommandLineLower matches "*net user*/add*" OR CommandLineLower matches "*net localgroup*administrators*", 1, 0)
| eval ShadowDelete = if(CommandLineLower matches "*vssadmin*delete*shadows*" OR CommandLineLower matches "*wmic*shadowcopy*delete*", 1, 0)
| eval BCDEdit = if(CommandLineLower matches "*bcdedit*/set*", 1, 0)
| eval BitsAdminAbuse = if(CommandLineLower matches "*bitsadmin*/transfer*" OR CommandLineLower matches "*bitsadmin*/create*", 1, 0)
| eval SuspiciousParent = if(ParentImage matches "*winword.exe" OR ParentImage matches "*excel.exe" OR ParentImage matches "*powerpnt.exe" OR ParentImage matches "*outlook.exe" OR ParentImage matches "*mshta.exe" OR ParentImage matches "*wscript.exe" OR ParentImage matches "*cscript.exe" OR ParentImage matches "*rundll32.exe" OR ParentImage matches "*regsvr32.exe", 1, 0)
| eval SuspicionScore = CertutilAbuse + ScheduledTask + UserCreation + ShadowDelete + BCDEdit + BitsAdminAbuse + SuspiciousParent
| where SuspicionScore > 0
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, CertutilAbuse, ScheduledTask, UserCreation, ShadowDelete, BCDEdit, BitsAdminAbuse, SuspiciousParent, SuspicionScore
| sort by _messageTime descSumo Logic query detecting T1059.003 Windows Command Shell abuse by parsing Sysmon EventID 1 process-creation records from Windows endpoints. Extracts cmd.exe command lines and parent process names, then scores each event across seven abuse categories. Events scoring above zero are surfaced for triage.
Data Sources
Required Tables
False Positives & Tuning
- Automated deployment pipelines (Jenkins, GitHub Actions self-hosted runners) invoking cmd.exe with certutil for certificate thumbprint verification or base64 decoding of build secrets
- Windows Server scheduled tasks created by DBA tooling that use cmd.exe wrappers around SQL Server management scripts with schtasks and reg commands
- Antivirus or EDR remediation scripts that spawn cmd.exe to invoke icacls or takeown when quarantining files or repairing permissions after malware removal
Other platforms for T1059.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Certutil Download Cradle
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'certutil -urlcache'. Child process event for certutil.exe. Sysmon Event ID 3: Network Connection attempt to 127.0.0.1:8080.
- Test 2Shadow Copy Deletion via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with CommandLine containing 'vssadmin'. Note: this test uses 'list' instead of 'delete' for safety. In real attacks, 'delete shadows /all /quiet' would be used.
- Test 3Scheduled Task Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe spawning schtasks.exe. Security Event ID 4698: Scheduled Task Created with task name 'df00tech-test'.
- Test 4Local Account Creation via cmd.exe
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with 'net user' in CommandLine. Security Event ID 4720: User Account Created. Security Event ID 4732: Member Added to Security-Enabled Local Group.
References (6)
- https://attack.mitre.org/techniques/T1059/003/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.003/T1059.003.md
- https://lolbas-project.github.io/
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh
Unlock Pro Content
Get the full detection package for T1059.003 including response playbook, investigation guide, and atomic red team tests.