SigmaHQ/rules/windows/process_creation/win_multiple_suspicious_cli.yml

title: Quick Execution of a Series of Suspicious Commands
description: Detects multiple suspicious process in a limited timeframe
status: experimental
references:
  - https://car.mitre.org/wiki/CAR-2013-04-002
author: juju4
modified: 2012/12/11
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine:
      - arp.exe
      - at.exe
      - attrib.exe
      - cscript.exe
      - dsquery.exe
      - hostname.exe
      - ipconfig.exe
      - mimikatz.exe
      - nbstat.exe
      - net.exe
      - netsh.exe
      - nslookup.exe
      - ping.exe
      - quser.exe
      - qwinsta.exe
      - reg.exe
      - runas.exe
      - sc.exe
      - schtasks.exe
      - ssh.exe
      - systeminfo.exe
      - taskkill.exe
      - telnet.exe
      - tracert.exe
      - wscript.exe
      - xcopy.exe
      - pscp.exe
      - copy.exe
      - robocopy.exe
      - certutil.exe
      - vssadmin.exe
      - powershell.exe
      - wevtutil.exe
      - psexec.exe
      - bcedit.exe
      - wbadmin.exe
      - icacls.exe
      - diskpart.exe
  timeframe: 5m
  condition: selection | count() by MachineName > 5
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: low