Query: alert when Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduc
Matching passage: Sigma rule: Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduc. Logsource: windows / process_creation. Rule: title: Cmd Launched with Hidden Start Flags to Suspicious Targets id: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d status: experimental description: 'Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories. This technique was observed in Chaos, DarkSide, and Emotet malware campaigns. ' references: - https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous - https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions - https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start tags: - attack.stealth - attack.t1564.003 author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-24 logsource: category: process_creation product: windows detection: selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_hidden_start_1: CommandLine|contains|windash: - 'start ' - start/b - start/min selection_cmd_hidden_start_2: CommandLine|contains|windash: - '/b ' - /b" - '/min ' - /min" selection_cli_uncommon_location: CommandLine|contains: - :\Perflogs\ - :\Temp\ - :\Users\Default\ - :\Windows\Temp\ - \AppData\Roaming\ - \Contacts\ - \Documents\ - \Downloads\ - \Favorites\ - \Favourites\ - \inetpub\ - \Music\ - \Photos\ - \Temporary Internet\ - \Users\Public\ - \Videos\ selection_cli_susp_extension: CommandLine|contains: - .bat - .cmd - .cpl - .hta - .js - .ps1 - .scr - .vbe - .vbs selection_cli_susp_pattern: CommandLine|contains: - ' -nop ' - ' -sta ' - .downloadfile( - .downloadstring( - '-noni ' - '-w hidden ' condition: all of selection_cmd_* and 1 of selection_cli_* falsepositives: - Legitimate administrative scripts running from temporary folders. - Niche software updaters utilizing hidden batch files in ProgramData. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml
Near-miss passage: Sigma rule: Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service. Logsource: windows / security. Rule: title: Password Change on Directory Service Restore Mode (DSRM) Account id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 related: - id: b61e87c0-50db-4b2e-8986-6a2be94b33b0 type: similar status: stable description: 'Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence. ' references: - https://adsecurity.org/?p=1714 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794 author: Thomas Patzke date: 2017-02-19 modified: 2020-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: 4794 condition: selection falsepositives: - Initial installation of a domain controller. level: high