T1059.003 Windows Command Shell — Detection Rules

Source-backed rule directory

• AWS EC2 Startup Shell Script Change · test · high · {"product":"aws","service":"cloudtrail"}
• Remote Access Tool - ScreenConnect Command Execution · test · low · {"service":"application","product":"windows"}
• Remote Access Tool - ScreenConnect File Transfer · test · low · {"service":"application","product":"windows"}
• AppLocker Prevented Application or Script from Running · test · medium · {"product":"windows","service":"applocker"}
• DNS Query by Finger Utility · experimental · high · {"product":"windows","category":"dns_query"}
• Remote Access Tool - ScreenConnect Temporary File · test · low · {"category":"file_event","product":"windows"}
• Network Connection Initiated via Finger.EXE · experimental · high · {"category":"network_connection","product":"windows"}
• Powershell Execute Batch Script · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Command Line Execution with Suspicious URL and AppData Strings · test · medium · {"category":"process_creation","product":"windows"}
• Potential CommandLine Path Traversal Via Cmd.EXE · test · high · {"category":"process_creation","product":"windows"}
• Read Contents From Stdin Via Cmd.EXE · test · medium · {"category":"process_creation","product":"windows"}
• OpenEDR Spawning Command Shell · experimental · medium · {"product":"windows","category":"process_creation"}
• Powershell Executed From Headless ConHost Process · test · medium · {"category":"process_creation","product":"windows"}
• Conhost.exe CommandLine Path Traversal · test · high · {"category":"process_creation","product":"windows"}
• HTML Help HH.EXE Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
• Suspicious HH.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
• Operator Bloopers Cobalt Strike Commands · test · high · {"category":"process_creation","product":"windows"}
• Operator Bloopers Cobalt Strike Modules · test · high · {"category":"process_creation","product":"windows"}
• HackTool - CrackMapExec Execution · test · high · {"category":"process_creation","product":"windows"}
• HackTool - CrackMapExec Execution Patterns · stable · high · {"category":"process_creation","product":"windows"}
• HackTool - Jlaive In-Memory Assembly Execution · test · medium · {"product":"windows","category":"process_creation"}
• HackTool - Koadic Execution · test · high · {"category":"process_creation","product":"windows"}
• HackTool - RedMimicry Winnti Playbook Execution · test · high · {"product":"windows","category":"process_creation"}
• Suspicious HWP Sub Processes · test · high · {"category":"process_creation","product":"windows"}
• PUA - AdvancedRun Execution · test · medium · {"product":"windows","category":"process_creation"}
• Remote Access Tool - ScreenConnect Remote Command Execution · test · low · {"category":"process_creation","product":"windows"}
• Suspicious Usage of For Loop with Recursive Directory Search in CMD · experimental · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1059.003 Windows Command Shell

MATCH(process_name IN [cmd.exe, command.com]) AND command_line MATCHES suspicious_command_patterns -> ALERT

• Process Execution Logs
• Windows Security Event Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0202 Behavioral Detection of Windows Command Shell Execution

AN0578 Analytic 0578

Detects interactive or scripted abuse of cmd.exe, batch files, or shell invocation chains. Focuses on parent-child relationships (e.g., cmd.exe launched from unusual parents), anomalous command-line parameters, and chaining with discovery, credential access, or lateral movement behaviors.