Sigma rule: Potential File Override/Append Via SET Command

Rule

Title

Potential File Override/Append Via SET Command

Status

test

Level

low

Author

Nasreddine Bencherchali (Nextron Systems), MahirAli Khan (in/mahiralikhan)

Date

2024-08-22

File

rules-threat-hunting/windows/process_creation/proc_creation_win_cmd_set_prompt_abuse.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign.
Attackers used this technique along with an append redirection operator ">>" in order to update the content of a file indirectly.
Ex: cmd /c >> example.txt set /p="test data". This will append "test data" to contents of "example.txt".
The typical use case of the "set /p=" command is to prompt the user for input.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\cmd.exe'
    - OriginalFileName: 'Cmd.Exe'
selection_cli:
    CommandLine|contains:
        - '/c set /p='
        - '"set /p='
        - '>>*set /p=' # To catch edge cases where the attacker passes it via a "cmd /c"
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate use of the SET with the "/p" flag for user prompting. command in administrative scripts or user-generated scripts.

Tags

• attack.execution
• detection.threat-hunting
• attack.stealth

References

• https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
• https://ss64.com/nt/set.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_cmd_set_prompt_abuse.yml