{"id":"a16980c2-0c56-4de0-9a79-17971979efdd","title":"Cmd.EXE Missing Space Characters Execution Anomaly","description":"Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.\nThis could be a sign of obfuscation of a fat finger problem (typo by the developer).\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-23","modified":"2026-05-13","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of cmd.exe with no arguments e.g. via system(\"\") in C to enable ANSI escape codes"],"references":["https://twitter.com/cyb3rops/status/1562072617552678912","https://ss64.com/nt/cmd.html"],"source_path":"rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml","source_sha256":"e670b384973fa0526946ac1bd44a3cbcbf4c7813e980623c0419bc8341f057c8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cmd.EXE Missing Space Characters Execution Anomaly\nid: a16980c2-0c56-4de0-9a79-17971979efdd\nstatus: test\ndescription: |\n    Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.\n    This could be a sign of obfuscation of a fat finger problem (typo by the developer).\nreferences:\n    - https://twitter.com/cyb3rops/status/1562072617552678912\n    - https://ss64.com/nt/cmd.html\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-08-23\nmodified: 2026-05-13\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection1:  # missing space before the /c\n        CommandLine|contains:\n            - 'cmd.exe/c'\n            - '\\cmd/c'  # just cmd/c would be prone to false positives\n            - '\"cmd/c'\n            - 'cmd.exe/k'\n            - '\\cmd/k'  # just cmd/k would be prone to false positives\n            - '\"cmd/k'\n            - 'cmd.exe/r'\n            - '\\cmd/r'  # just cmd/r would be prone to false positives\n            - '\"cmd/r'\n    selection2: # special cases verified via Virustotal Enterprise search\n        CommandLine|contains:\n            - '/cwhoami'\n            - '/cpowershell'\n            - '/cschtasks'\n            - '/cbitsadmin'\n            - '/ccertutil'\n            - '/kwhoami'\n            - '/kpowershell'\n            - '/kschtasks'\n            - '/kbitsadmin'\n            - '/kcertutil'\n    selection3:  # missing space after the /c\n        CommandLine|contains:\n            - 'cmd.exe /c'\n            - 'cmd /c'\n            - 'cmd.exe /k'\n            - 'cmd /k'\n            - 'cmd.exe /r'\n            - 'cmd /r'\n    filter_generic:\n        CommandLine|contains:\n            - 'cmd.exe /c '\n            - 'cmd /c '\n            - 'cmd.exe /k '\n            - 'cmd /k '\n            - 'cmd.exe /r '\n            - 'cmd /r '\n    filter_fp:\n        - CommandLine|contains: 'AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\node_modules'\n        - CommandLine|endswith: 'cmd.exe/c .'\n        - CommandLine: 'cmd.exe /c'\n        - CommandLine: 'cmd /c'\n    condition: 1 of selection* and not 1 of filter_*\nfalsepositives:\n    - Legitimate use of cmd.exe with no arguments e.g. via system(\"\") in C to enable ANSI escape codes\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/a16980c2-0c56-4de0-9a79-17971979efdd.json","kind":"sigma"}