CMD Shell Output Redirect
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the use of the redirection character ">" to redirect information on the command line. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
Severity
Attention
Rule Requirement
Criteria
Action1: actionname = "Process started" AND ((ORIGINALFILENAME = "Cmd.Exe" OR PROCESSNAME endswith "\cmd.exe") AND COMMANDLINE contains ">") AND COMMANDLINE notcontains "C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe,chrome-extension://,\.\pipe\chrome.nativeMessaging" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
