{"id":"c7942406-33dd-4377-a564-0f62db0593a3","title":"Suspicious CodePage Switch Via CHCP","description":"Detects a code page switch in command line or batch scripts to a rare language","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2019-10-14","modified":"2023-03-07","tags":["attack.stealth","attack.t1036"],"technique_ids":["T1036"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrative activity (adjust code pages according to your organization's region)"],"references":["https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers","https://twitter.com/cglyer/status/1183756892952248325"],"source_path":"rules/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml","source_sha256":"f8e154cb65821a73053668335ac5c9a698dfb803db8f37510e330c7c064595db","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious CodePage Switch Via CHCP\nid: c7942406-33dd-4377-a564-0f62db0593a3\nstatus: test\ndescription: Detects a code page switch in command line or batch scripts to a rare language\nreferences:\n    - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers\n    - https://twitter.com/cglyer/status/1183756892952248325\nauthor: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community\ndate: 2019-10-14\nmodified: 2023-03-07\ntags:\n    - attack.stealth\n    - attack.t1036\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\chcp.com'\n        CommandLine|endswith:\n            - ' 936'    # Chinese\n            # - ' 1256' # Arabic\n            - ' 1258'   # Vietnamese\n            # - ' 855'  # Russian\n            # - ' 866'  # Russian\n            # - ' 864'  # Arabic\n    condition: selection\nfalsepositives:\n    - Administrative activity (adjust code pages according to your organization's region)\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/c7942406-33dd-4377-a564-0f62db0593a3.json","kind":"sigma"}