Potential Commandline Obfuscation Using Escape Characters

Title: Potential Commandline Obfuscation Using Escape Characters
Status: test
Description:Detects potential commandline obfuscation using known escape characters
References:
  -https://twitter.com/vysecurity/status/885545634958385153
  -https://twitter.com/Hexacorn/status/885553465417756673
  -https://twitter.com/Hexacorn/status/885570278637678592
  -https://www.mandiant.com/resources/blog/obfuscation-wild-targeted-attackers-lead-way-evasion-techniques
  -https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/
Author: juju4
Date: 2018-12-11
modified:2023-03-03
Tags:

• -'attack.stealth'
• -'attack.t1140'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains:
      -'h^t^t^p'
      -'h"t"t"p'

  condition:selection
Falsepositives:
  -Unknown
Level: medium