Sigma rule: Potential Commandline Obfuscation Using Escape Characters
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-48ea157eb0dd, updated 2023-03-03T00:00:00.000Z.
Rule
- Title
- Potential Commandline Obfuscation Using Escape Characters
- Status
- test
- Level
- medium
- Author
- juju4
- Date
- 2018-12-11
- Modified
- 2023-03-03
- File
- rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects potential commandline obfuscation using known escape characters
Log source
- product
- windows
- category
- process_creation
Detection
selection:
CommandLine|contains:
# - <TAB> # no TAB modifier in sigmac yet, so this matches <TAB> (or TAB in elasticsearch backends without DSL queries)
- 'h^t^t^p'
- 'h"t"t"p'
condition: selectionFalse positives (as the rule lists them)
- Unknown
Tags
- attack.stealth
- attack.t1140
MITRE ATT&CK ids this rule names
References
- https://twitter.com/vysecurity/status/885545634958385153
- https://twitter.com/Hexacorn/status/885553465417756673
- https://twitter.com/Hexacorn/status/885570278637678592
- https://www.mandiant.com/resources/blog/obfuscation-wild-targeted-attackers-lead-way-evasion-techniques
- https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml
Sources and licences
SigmaHQ
"Potential Commandline Obfuscation Using Escape Characters" by juju4 (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Potential Commandline Obfuscation Using Escape Characters",
entity page, dataset version ref-48ea157eb0dd, updated 2023-03-03T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd (accessed 2026-11-03).
Underlying source: SigmaHQ rule f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.