rules/windows/process_creation/win_commandline_path_traversal.yml

title: Cmd.exe CommandLine Path Traversal
id: 087790e3-3287-436c-bccf-cbd0184a7db1
status: test
description: detects the usage of path traversal in cmd.exe indicating possible command/argument confusion/hijacking
author: xknow @xknow_infosec
references:
  - https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/
  - https://twitter.com/Oddvarmoe/status/1270633613449723905
date: 2020/06/11
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentCommandLine|contains|all:
      - 'cmd'
      - '/c'
    CommandLine|contains: '/../../'
  condition: selection
falsepositives:
  - (not much) some benign Java tools may product false-positive commandlines for loading libraries
level: high
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059    # an old one
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`title: Cmd.exe CommandLine Path Traversal`
			`id: 087790e3-3287-436c-bccf-cbd0184a7db1`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`description: detects the usage of path traversal in cmd.exe indicating possible command/argument confusion/hijacking`
			`author: xknow @xknow_infosec`
			`references:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/`
			`- https://twitter.com/Oddvarmoe/status/1270633613449723905`
			`date: 2020/06/11`
			`modified: 2021/11/27`
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: process_creation`
			`product: windows`
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection:`
			`ParentCommandLine\|contains\|all:`
			`- 'cmd'`
			`- '/c'`
			`CommandLine\|contains: '/../../'`
			`condition: selection`
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- (not much) some benign Java tools may product false-positive commandlines for loading libraries`
Update win_commandline_path_traversal.yml 2020-11-27 12:13:45 -03:00			`level: high`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`tags:`
			`- attack.execution`
			`- attack.t1059.003`
			`- attack.t1059 # an old one`