Skip to content
Threat Feed
Subscribe

Tag

Cmd

3 briefs RSS
high advisory

Suspicious Windows Command Shell Arguments Detection

This rule identifies the execution of the Windows Command Shell process (cmd.exe) with suspicious argument values, often observed during malware installation.

m365_defender +3 malware execution cmd
3r 2t
medium advisory

Suspicious Svchost.exe Spawning Cmd.exe

Detects suspicious activity where svchost.exe spawns cmd.exe, potentially indicating malware masquerading or privilege escalation on Windows systems.

Windows execution svchost cmd
2r 2t
medium advisory

Suspicious Command Execution via SolarWinds Process

This brief covers the detection of suspicious command execution, specifically Cmd.exe or PowerShell.exe, as child processes of legitimate SolarWinds executables, indicative of potential supply chain compromise and unauthorized command execution on Windows systems.

SolarWinds Orion supply-chain solarwinds command-execution powershell cmd
2r 3t