34 lines
950 B
YAML
34 lines
950 B
YAML
|
|
title: Cmd.exe CommandLine Path Traversal
|
|
author: xknow @xknow_infosec
|
|
date: 2020/06/11
|
|
description: detects the usage of path traversal in cmd.exe indicating possible command/argument
|
|
confusion/hijacking
|
|
detection:
|
|
SELECTION_1:
|
|
EventID: 1
|
|
SELECTION_2:
|
|
ParentCommandLine: '*cmd*'
|
|
SELECTION_3:
|
|
ParentCommandLine: '*/c*'
|
|
SELECTION_4:
|
|
CommandLine: '*/../../*'
|
|
condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
|
|
falsepositives:
|
|
- (not much) some benign Java tools may product false-positive commandlines for loading
|
|
libraries
|
|
id: 087790e3-3287-436c-bccf-cbd0184a7db1
|
|
level: high
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
references:
|
|
- https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/
|
|
- https://twitter.com/Oddvarmoe/status/1270633613449723905
|
|
status: experimental
|
|
tags:
|
|
- attack.execution
|
|
- attack.t1059.003
|
|
- attack.t1059
|
|
ruletype: SIGMA
|