Sigma rule: Cmd.EXE Missing Space Characters Execution Anomaly

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-723d70b4e51d, updated 2026-05-13T00:00:00.000Z.

Rule

Title: Cmd.EXE Missing Space Characters Execution Anomaly
Status: test
Level: high
Author: Florian Roth (Nextron Systems)
Date: 2022-08-23
Modified: 2026-05-13
File: rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.
This could be a sign of obfuscation of a fat finger problem (typo by the developer).

Log source

product: windows
category: process_creation

Detection

selection1:  # missing space before the /c
    CommandLine|contains:
        - 'cmd.exe/c'
        - '\cmd/c'  # just cmd/c would be prone to false positives
        - '"cmd/c'
        - 'cmd.exe/k'
        - '\cmd/k'  # just cmd/k would be prone to false positives
        - '"cmd/k'
        - 'cmd.exe/r'
        - '\cmd/r'  # just cmd/r would be prone to false positives
        - '"cmd/r'
selection2: # special cases verified via Virustotal Enterprise search
    CommandLine|contains:
        - '/cwhoami'
        - '/cpowershell'
        - '/cschtasks'
        - '/cbitsadmin'
        - '/ccertutil'
        - '/kwhoami'
        - '/kpowershell'
        - '/kschtasks'
        - '/kbitsadmin'
        - '/kcertutil'
selection3:  # missing space after the /c
    CommandLine|contains:
        - 'cmd.exe /c'
        - 'cmd /c'
        - 'cmd.exe /k'
        - 'cmd /k'
        - 'cmd.exe /r'
        - 'cmd /r'
filter_generic:
    CommandLine|contains:
        - 'cmd.exe /c '
        - 'cmd /c '
        - 'cmd.exe /k '
        - 'cmd /k '
        - 'cmd.exe /r '
        - 'cmd /r '
filter_fp:
    - CommandLine|contains: 'AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules'
    - CommandLine|endswith: 'cmd.exe/c .'
    - CommandLine: 'cmd.exe /c'
    - CommandLine: 'cmd /c'
condition: 1 of selection* and not 1 of filter_*

False positives (as the rule lists them)

Legitimate use of cmd.exe with no arguments e.g. via system("") in C to enable ANSI escape codes

MITRE ATT&CK ids this rule names

T1059.001

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml

Sources and licences

SigmaHQ
"Cmd.EXE Missing Space Characters Execution Anomaly" by Florian Roth (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Cmd.EXE Missing Space Characters Execution Anomaly",
entity page, dataset version ref-723d70b4e51d, updated 2026-05-13T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/a16980c2-0c56-4de0-9a79-17971979efdd (accessed 2026-11-03).
Underlying source: SigmaHQ rule a16980c2-0c56-4de0-9a79-17971979efdd, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.