title: Cmd.exe CommandLine Path Traversal
id: 087790e3-3287-436c-bccf-cbd0184a7db1
status: test
description: detects the usage of path traversal in cmd.exe indicating possible command/argument confusion/hijacking
author: xknow @xknow_infosec, Tim Shelton
references:
  - https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/
  - https://twitter.com/Oddvarmoe/status/1270633613449723905
date: 2020/06/11
modified: 2022/03/17
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentCommandLine|contains|all:
      - 'cmd'
      - '/c'
    CommandLine|contains: '/../../'
  falsepositive_1:
    CommandLine|contains: '\Tasktop\keycloak\bin\/../../jre\bin\java'
  condition: selection and not 1 of falsepositive*
falsepositives:
  - (not much) some benign Java tools may product false-positive commandlines for loading libraries
level: high
tags:
  - attack.execution
  - attack.t1059.003
