Sigma rule: Potential Dosfuscation Activity

Rule

Title

Potential Dosfuscation Activity

Status

test

Level

medium

Author

frack113, Nasreddine Bencherchali (Nextron Systems)

Date

2022-02-15

Modified

2023-03-06

File

rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects possible payload obfuscation via the commandline

Log source

product

windows

category

process_creation

Detection

selection:
    CommandLine|contains:
        - '^^'
        - '^|^'
        - ',;,'
        - ';;;;'
        - ';; ;;'
        - '(,(,'
        - '%COMSPEC:~'
        - ' c^m^d'
        - '^c^m^d'
        - ' c^md'
        - ' cm^d'
        - '^cm^d'
        - ' s^et '
        - ' s^e^t '
        - ' se^t '
        # - '%%'
        # - '&&'
        # - '""'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059

MITRE ATT&CK ids this rule names

• T1059

References

• https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
• https://github.com/danielbohannon/Invoke-DOSfuscation

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml