{"id":"5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d","title":"Cmd Launched with Hidden Start Flags to Suspicious Targets","description":"Detects cmd.exe executing commands with the \"start\" utility using \"/b\" (no window) or \"/min\" (minimized) flags.\nTo reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories.\nThis technique was observed in Chaos, DarkSide, and Emotet malware campaigns.\n","author":"Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-01-24","modified":"","tags":["attack.stealth","attack.t1564.003"],"technique_ids":["T1564.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administrative scripts running from temporary folders.","Niche software updaters utilizing hidden batch files in ProgramData."],"references":["https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous","https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions","https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start"],"source_path":"rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml","source_sha256":"322fca5ce3e60c1c04bd9988dcf5855f9f2c586ba81c76b9d03604ec595ec8d4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cmd Launched with Hidden Start Flags to Suspicious Targets\nid: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d\nstatus: experimental\ndescription: |\n    Detects cmd.exe executing commands with the \"start\" utility using \"/b\" (no window) or \"/min\" (minimized) flags.\n    To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories.\n    This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.\nreferences:\n    - https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous\n    - https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions\n    - https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start\ntags:\n    - attack.stealth\n    - attack.t1564.003\nauthor: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-01-24\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cmd_img:\n        - Image|endswith: '\\cmd.exe'\n        - OriginalFileName: 'Cmd.Exe'\n    selection_cmd_hidden_start_1:\n        CommandLine|contains|windash:\n            - 'start '\n            - 'start/b'\n            - 'start/min'\n    selection_cmd_hidden_start_2:\n        CommandLine|contains|windash:\n            - '/b '\n            - '/b\"'\n            - '/min '\n            - '/min\"'\n    selection_cli_uncommon_location:\n        CommandLine|contains:\n            - ':\\Perflogs\\'\n            - ':\\Temp\\'\n            - ':\\Users\\Default\\'\n            - ':\\Windows\\Temp\\'\n            - '\\AppData\\Roaming\\'\n            - '\\Contacts\\'\n            - '\\Documents\\'\n            - '\\Downloads\\'\n            - '\\Favorites\\'\n            - '\\Favourites\\'\n            - '\\inetpub\\'\n            - '\\Music\\'\n            - '\\Photos\\'\n            - '\\Temporary Internet\\'\n            - '\\Users\\Public\\'\n            - '\\Videos\\'\n    selection_cli_susp_extension:\n        CommandLine|contains:\n            - '.bat'\n            - '.cmd'\n            - '.cpl'\n            - '.hta'\n            - '.js'\n            - '.ps1'\n            - '.scr'\n            - '.vbe'\n            - '.vbs'\n    selection_cli_susp_pattern:\n        CommandLine|contains:\n            - ' -nop '\n            - ' -sta '\n            - '.downloadfile(' # PowerShell download command\n            - '.downloadstring(' # PowerShell download command\n            - '-noni '\n            - '-w hidden '\n    condition: all of selection_cmd_* and 1 of selection_cli_*\nfalsepositives:\n    - Legitimate administrative scripts running from temporary folders.\n    - Niche software updaters utilizing hidden batch files in ProgramData.\nlevel: medium # Can be increased after an initial baseline and tuning\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564.003","id":"T1564.003","name":"Hidden Window","page":"techniques/enterprise/T1564.003/"}],"data_path":"data/detection-rules/5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d.json","kind":"sigma"}