Suspicious CodePage Switch Via CHCP — Sigma Rule

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community. Source status: test; severity: medium. Source dates: 2019-10-14 / 2023-03-07.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: f8e154cb65821a73053668335ac5c9a698dfb803db8f37510e330c7c064595db

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious CodePage Switch Via CHCP
id: c7942406-33dd-4377-a564-0f62db0593a3
status: test
description: Detects a code page switch in command line or batch scripts to a rare language
references:
    - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
    - https://twitter.com/cglyer/status/1183756892952248325
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
date: 2019-10-14
modified: 2023-03-07
tags:
    - attack.stealth
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\chcp.com'
        CommandLine|endswith:
            - ' 936'    # Chinese
            # - ' 1256' # Arabic
            - ' 1258'   # Vietnamese
            # - ' 855'  # Russian
            # - ' 866'  # Russian
            # - ' 864'  # Arabic
    condition: selection
falsepositives:
    - Administrative activity (adjust code pages according to your organization's region)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch/info.yml

Original YAML and metadata in JSON

False positives

• Administrative activity (adjust code pages according to your organization's region)

Source references

• https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
• https://twitter.com/cglyer/status/1183756892952248325