title: Suspicious Code Page Switch
id: c7942406-33dd-4377-a564-0f62db0593a3
status: test
description: Detects a code page switch in command line or batch scripts to a rare language
author: Florian Roth, Jonhnathan Ribeiro, oscd.community
references:
  - https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  - https://twitter.com/cglyer/status/1183756892952248325
date: 2019/10/14
modified: 2022/01/07
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\chcp.com'
    CommandLine|endswith:
      - ' 936'          # Chinese
            # - ' 1256' # Arabic
      - ' 1258'         # Vietnamese
            # - ' 855'  # Russian
            # - ' 866'  # Russian
            # - ' 864'  # Arabic
  condition: selection
fields:
  - ParentCommandLine
falsepositives:
  - Administrative activity (adjust code pages according to your organisation's region)
level: medium
tags:
  - attack.t1036
  - attack.defense_evasion
