
title: Quick Execution of a Series of Suspicious Commands
author: juju4
date: 2019/01/16
description: Detects multiple suspicious process in a limited timeframe
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine:
    - '*arp.exe*'
    - '*at.exe*'
    - '*attrib.exe*'
    - '*cscript.exe*'
    - '*dsquery.exe*'
    - '*hostname.exe*'
    - '*ipconfig.exe*'
    - '*mimikatz.exe*'
    - '*nbtstat.exe*'
    - '*net.exe*'
    - '*netsh.exe*'
    - '*nslookup.exe*'
    - '*ping.exe*'
    - '*quser.exe*'
    - '*qwinsta.exe*'
    - '*reg.exe*'
    - '*runas.exe*'
    - '*sc.exe*'
    - '*schtasks.exe*'
    - '*ssh.exe*'
    - '*systeminfo.exe*'
    - '*taskkill.exe*'
    - '*telnet.exe*'
    - '*tracert.exe*'
    - '*wscript.exe*'
    - '*xcopy.exe*'
    - '*pscp.exe*'
    - '*copy.exe*'
    - '*robocopy.exe*'
    - '*certutil.exe*'
    - '*vssadmin.exe*'
    - '*powershell.exe*'
    - '*wevtutil.exe*'
    - '*psexec.exe*'
    - '*bcedit.exe*'
    - '*wbadmin.exe*'
    - '*icacls.exe*'
    - '*diskpart.exe*'
  condition: (SELECTION_1 and SELECTION_2) | count() by MachineName > 5
falsepositives:
- False positives depend on scripts and administrative tools used in the monitored
  environment
id: 61ab5496-748e-4818-a92f-de78e20fe7f1
level: low
logsource:
  category: process_creation
  product: windows
modified: 2021/06/13
references:
- https://car.mitre.org/wiki/CAR-2013-04-002
status: experimental
tags:
- car.2013-04-002
- attack.execution
- attack.t1059
ruletype: SIGMA
