Potential Dosfuscation Activity

Title: Potential Dosfuscation Activity
Status: test
Description:Detects possible payload obfuscation via the commandline
References:
  -https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
  -https://github.com/danielbohannon/Invoke-DOSfuscation
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-02-15
modified:2023-03-06
Tags:

• -'attack.execution'
• -'attack.t1059'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains:
      -'^^'
      -'^|^'
      -',;,'
      -';;;;'
      -';; ;;'
      -'(,(,'
      -'%COMSPEC:~'
      -' c^m^d'
      -'^c^m^d'
      -' c^md'
      -' cm^d'
      -'^cm^d'
      -' s^et '
      -' s^e^t '
      -' se^t '

  condition:selection
Falsepositives:
  -Unknown
Level: medium