Sigma rule: Cmd Launched with Hidden Start Flags to Suspicious Targets

Rule

Title

Cmd Launched with Hidden Start Flags to Suspicious Targets

Status

experimental

Level

medium

Author

Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-01-24

File

rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags.
To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories.
This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.

Log source

product

windows

category

process_creation

Detection

selection_cmd_img:
    - Image|endswith: '\cmd.exe'
    - OriginalFileName: 'Cmd.Exe'
selection_cmd_hidden_start_1:
    CommandLine|contains|windash:
        - 'start '
        - 'start/b'
        - 'start/min'
selection_cmd_hidden_start_2:
    CommandLine|contains|windash:
        - '/b '
        - '/b"'
        - '/min '
        - '/min"'
selection_cli_uncommon_location:
    CommandLine|contains:
        - ':\Perflogs\'
        - ':\Temp\'
        - ':\Users\Default\'
        - ':\Windows\Temp\'
        - '\AppData\Roaming\'
        - '\Contacts\'
        - '\Documents\'
        - '\Downloads\'
        - '\Favorites\'
        - '\Favourites\'
        - '\inetpub\'
        - '\Music\'
        - '\Photos\'
        - '\Temporary Internet\'
        - '\Users\Public\'
        - '\Videos\'
selection_cli_susp_extension:
    CommandLine|contains:
        - '.bat'
        - '.cmd'
        - '.cpl'
        - '.hta'
        - '.js'
        - '.ps1'
        - '.scr'
        - '.vbe'
        - '.vbs'
selection_cli_susp_pattern:
    CommandLine|contains:
        - ' -nop '
        - ' -sta '
        - '.downloadfile(' # PowerShell download command
        - '.downloadstring(' # PowerShell download command
        - '-noni '
        - '-w hidden '
condition: all of selection_cmd_* and 1 of selection_cli_*

False positives (as the rule lists them)

• Legitimate administrative scripts running from temporary folders.
• Niche software updaters utilizing hidden batch files in ProgramData.

Tags

• attack.stealth
• attack.t1564.003

MITRE ATT&CK ids this rule names

• T1564.003

References

• https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous
• https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
• https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml