rules/windows/process_creation/win_commandline_path_traversal.yml

title: Cmd.exe CommandLine Path Traversal
id: 087790e3-3287-436c-bccf-cbd0184a7db1
description: detects the usage of path traversal in cmd.exe indicating possible command/argument confusion/hijacking
status: experimental
date: 2020/06/11
author: xknow @xknow_infosec
references:
    - https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/
    - https://twitter.com/Oddvarmoe/status/1270633613449723905
tags:
    - attack.execution
    - attack.t1059.003
    - attack.t1059  # an old one
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentCommandLine|contains: 'cmd*/c'
        CommandLine|contains: '/../../'
    condition: selection
falsepositives:
    - (not much) some benign Java tools may product false-positive commandlines for loading libraries
level: high
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`title: Cmd.exe CommandLine Path Traversal`
			`id: 087790e3-3287-436c-bccf-cbd0184a7db1`
			`description: detects the usage of path traversal in cmd.exe indicating possible command/argument confusion/hijacking`
			`status: experimental`
			`date: 2020/06/11`
			`author: xknow @xknow_infosec`
			`references:`
			`- https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/`
			`- https://twitter.com/Oddvarmoe/status/1270633613449723905`
			`tags:`
			`- attack.execution`
att&ck tags review: windows/process_creation part 2 2020-08-29 04:39:30 +00:00			`- attack.t1059.003`
			`- attack.t1059 # an old one`
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`logsource:`
updated to process_creation 2020-06-11 15:58:05 +02:00			`category: process_creation`
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`product: windows`
			`detection:`
removed one field 2020-06-11 16:23:15 +02:00			`selection:`
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`ParentCommandLine\|contains: 'cmd*/c'`
			`CommandLine\|contains: '/../../'`
removed one field 2020-06-11 16:23:15 +02:00			`condition: selection`
Cmd.exe Path Traversal Detection 2020-06-11 15:48:48 +02:00			`falsepositives:`
			`- (not much) some benign Java tools may product false-positive commandlines for loading libraries`
			`level: high`