Batch file run by the command shell from a user-writable path

1title: Batch file run by the command shell from a user-writable path2id: 8ce47038-ef50-40e1-ab92-98e0b623982d3status: experimental4description: |5  AN0578 asks for interactive or scripted abuse of cmd.exe and batch files, but6  the bare observable — the command shell started — happens thousands of times a7  day on a healthy host, so this rule keeps MITRE's ScriptStoragePath knob and8  drops the rest: cmd.exe running a .bat or .cmd whose path sits in a staging9  directory any unprivileged account can write to, populated here with the10  per-user and Windows temp directories, roaming AppData, the public profile,11  Downloads, %ProgramData% and the recycle bin. The ParentProcessName knob12  MITRE names alongside it — cmd.exe spawned by a document viewer or browser —13  is deliberately not written, because the corpus already carries that lineage14  under T1204 and T1203 and a third copy would add no coverage; the15  CommandLinePattern knob is left out because chaining operators and `/c` are as16  common in vendor install scripts as in an implant. The brief offers Security17  EventID 4688 for this analytic but maps it onto the Sysmon-shaped18  `process_creation` category, and the rule is written in that vocabulary19  (`Image`, `CommandLine`): a 4688 feed needs `NewProcessName` mapped onto20  `Image` and `ProcessCommandLine` onto `CommandLine` before it can match at21  all, and 4688 itself requires *Audit Process Creation* plus the separate22  *Include command line in process creation events* policy, neither of which is23  on in a default install or in the MS/CIS baselines. AN0578's second log24  source, the Sysmon EventID 7 module load, is not used here. Two limits of the25  shape: the script name and the staging directory are independent substrings of26  the same `CommandLine`, so the rule does not actually assert that the batch27  file is the thing sitting in the writable path, and a batch file invoked by28  bare name from a working directory already set to that path puts no directory29  on the command line at all and is missed — on a Sysmon feed `CurrentDirectory`30  would close that gap, on a 4688 feed nothing does.31  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0202, not hand-written and not tested by its author. Any lab result is on this rule's own page.32references:33  - https://attack.mitre.org/techniques/T1059/00334  - https://attack.mitre.org/detectionstrategies/DET020235author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)36date: 2026-08-1637tags:38  - attack.execution39  - attack.t1059.00340logsource:41  category: process_creation42  product: windows43detection:44  selection_shell:45    Image|endswith: '\cmd.exe'46  selection_script:47    CommandLine|contains:48      - '.bat'49      - '.cmd'50  selection_staging_path:51    CommandLine|contains:52      - '\AppData\Local\Temp\'53      - '\AppData\Roaming\'54      - '\Windows\Temp\'55      - '\Users\Public\'56      - '\Downloads\'57      - '\ProgramData\'58      - '\$Recycle.Bin\'59  condition: selection_shell and selection_script and selection_staging_path60falsepositives:61  - "Installers, updaters and self-extracting archives that unpack a .bat or .cmd wrapper into the user or Windows temp directory and hand it to cmd.exe — MSI custom actions and vendor bootstrappers do this by design, and it is likely the largest single source of matches on a typical fleet."62  - "Endpoint-management and RMM platforms that stage remediation, inventory or detection scripts under %ProgramData% or the Windows temp directory before invoking them, which is the normal deployment path for configuration-management agents."63  - "Logon, imaging and build automation that keeps its batch files in the public profile so every account on a shared workstation, lab machine or kiosk can reach them."64  - "IT staff and developers running a downloaded setup or build script straight out of the Downloads folder, which produces the same shell-plus-user-writable-path event as a staged payload."65level: low