medium
advisory
Unusual Parent Process For Cmd.EXE
Detection logic for identifying cmd.exe spawned by specific parent processes.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 11:39 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
This detection monitors for the execution of cmd.exe when launched by specific, unusual parent processes on Windows systems.
Detection coverage 1
Unusual Parent Process For Cmd.EXE
mediumDetects suspicious parent process for cmd.exe
sigma
tactics: execution
techniques: T1059
sources: process_creation, windows
Detection queries are available on the platform. Get full rules →