Title:
Console CodePage Lookup Via CHCP
Status:
test
Description:Detects use of chcp to look up the system locale value as part of host discovery
References:
-https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
-https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
Author: _pete_0, TheDFIRReport
Date: 2022-02-21
modified:2024-03-05
Tags:
- -'attack.discovery'
- -'attack.t1614.001'
Logsource:
- category: process_creation
- product: windows
Detection:
selection:
ParentImage|endswith:
'\cmd.exe'
ParentCommandLine|contains|windash:
-' -c '
-' -r '
-' -k '
Image|endswith:
'\chcp.com'
CommandLine|endswith:
-'chcp'
-'chcp '
-'chcp '
condition:
selection
Falsepositives:
-During Anaconda update the 'conda.exe' process will eventually execution the 'chcp' command.
-Discord was seen using chcp to look up code pages
Level:
medium
