Detection of CMD.EXE Standard Input Redirection
This rule identifies the use of the '<' operator with cmd.exe to read content from files or streams, a technique often used by attackers to bypass execution policy restrictions or bypass basic file-based detection.
Standard input (stdin) redirection via the '<' operator in cmd.exe is a command-line execution pattern used to feed file contents into a process. While often used for benign batch processing, it is frequently leveraged by threat actors to execute commands from hidden or non-executable files, thereby evading file-based signature detection or simple command-line monitoring. Defenders should monitor for this pattern to identify suspicious batch script execution or command injection attempts that rely on redirected input.
Impact
Successful abuse of stdin redirection allows attackers to execute arbitrary code or scripts from files that may not be directly called by traditional execution commands. This technique is often seen as a secondary stage in lateral movement or persistence, helping to obfuscate the origin of executed code from standard process telemetry.
Recommendation
Deploy the provided Sigma rule to identify command-line activity utilizing input redirection. Analysts should investigate instances where cmd.exe reads unexpected files or uses input redirection in conjunction with uncommon parent processes. Ensure process-creation logs (e.g., Sysmon Event ID 1) are enabled to capture full CommandLines.
Immediate actions
Deploy Sigma rule to monitor for cmd.exe stdin redirection
Threat Hunt
Search for historical cmd.exe command lines containing the '<' character to establish baselines
Data: Process creation events
Detection coverage 1
Detect Cmd.exe Standard Input Redirection
mediumDetects the use of the '<' operator with cmd.exe to read content from files, a common technique for command obfuscation.
Detection queries are available on the platform. Get full rules →