Home / Learning paths

Validate a command-shell detection candidate with benign events

Turn a documented behavior into a small, inspectable rule and test its positive and negative boundaries without executing a sample.

For analysts learning CTI-to-detection work, the useful output is a candidate plus evidence of what it matches. This example uses synthetic JSON shaped around Windows Security event 4688. It is an illustrative rule, not a production-ready detection or a reproduction of an intrusion.

Environment: Python 3.9 or later; no third-party packages, network connection, malware, or administrator access. Estimated time: 15 minutes. Review date: 2026-09-09; rule version: 1.0; taxonomy: Enterprise ATT&CK 19.1.

Evidence and candidate

MITRE T1059.003 describes Windows Command Shell execution. Its DET0202/AN0578 defensive guidance discusses parent-child relationships. Microsoft documents process creation event 4688; field availability varies by event version and audit configuration.

The rule below is an author's narrow inference from that guidance: flag a process-creation record whose parent basename is winword.exe and child basename is cmd.exe. It does not infer maliciousness or actor attribution.

Inputs and workflow

  1. Download events.json and validate.py into the same directory.
  2. Inspect both files. The events are synthetic; the command-line text is never executed.
  3. Run the reader below from that directory.
  4. Compare the reported IDs with the expected result and inspect the excluded events.
python3 validate.py events.json

Expected output and negative controls

{"candidate_ids": ["word-shell"], "events_read": 6}

The positive fixture uses uppercase WINWORD.EXE to exercise case normalization. Negative controls cover an ordinary Explorer parent, Word launching an editor, the wrong event type, missing parent telemetry, and a near-match executable name. Change one field at a time and explain why the decision changes.

If the JSON is malformed or the file is missing, Python reports a parsing or file error: fix the input before drawing conclusions. Missing fields fail to match and represent a visibility limitation. The repository regression test also checks an empty event and case variants.

Failure modes and limitations

Approved Office automation may launch a shell and produce a false positive. Other parents, renamed binaries, absent audit events, spoofed fields, or incomplete collection are outside this rule. Fixture success confirms only the implemented matching behavior. It does not validate Windows event generation, ingestion, SIEM translation, evasion resistance, or detection effectiveness in production.

Conclusion and next step

Keep source evidence, rule intent, fixture results, and visibility gaps together. Continue the CTI-to-detection path by checking your own telemetry schema and approved baseline before adapting the candidate.

References

Follow My Work

Research RSS · Medium · LinkedIn · GitHub · Contact