Environment-keyed conditional execution on the command line

Siemphony@siemphonymediumT1480unverifiedPlaybook · Defence evasion

The observable MITRE describes is a burst of discovery followed by execution that only proceeds when the collected values match an expected target — a threshold over a time window, which Sigma has no construct for. What survives into a single event is the shape of the guardrail itself: a command line that both reads an environment-identifying value and compares it. This rule therefore requires two matches on CommandLine, one for the identity source MITRE lists under EnvironmentalArtifactList (hostname, domain, logon server, hardware UUID, AD or interface enumeration) and one for the conditional operator that gates the payload on it. Discovery alone is left to T1082; neither the four-activity threshold nor the discovery-to-execution delay is encoded here, because faking them would need fields that do not exist. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0562, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Environment-keyed conditional execution on the command line2id: ce7e4089-ab36-41ec-828f-22846147096a3status: experimental4description: |5  The observable MITRE describes is a burst of discovery followed by execution6  that only proceeds when the collected values match an expected target — a7  threshold over a time window, which Sigma has no construct for. What survives8  into a single event is the shape of the guardrail itself: a command line that9  both reads an environment-identifying value and compares it. This rule10  therefore requires two matches on CommandLine, one for the identity source11  MITRE lists under EnvironmentalArtifactList (hostname, domain, logon server,12  hardware UUID, AD or interface enumeration) and one for the conditional13  operator that gates the payload on it. Discovery alone is left to T1082;14  neither the four-activity threshold nor the discovery-to-execution delay is15  encoded here, because faking them would need fields that do not exist.16  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0562, not hand-written and not tested by its author. Any lab result is on this rule's own page.17references:18  - https://attack.mitre.org/techniques/T148019  - https://attack.mitre.org/detectionstrategies/DET056220author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)21date: 2026-08-1622tags:23  - attack.defense-evasion24  - attack.t148025logsource:26  category: process_creation27  product: windows28detection:29  selection_environment:30    CommandLine|contains:31      - 'env:COMPUTERNAME'32      - 'env:USERDOMAIN'33      - 'env:USERDNSDOMAIN'34      - 'env:LOGONSERVER'35      - 'Win32_ComputerSystem'36      - 'Win32_ComputerSystemProduct'37      - 'csproduct get uuid'38      - 'computersystem get domain'39      - 'GetHostByName'40      - 'GetIPGlobalProperties'41      - 'Get-ADDomain'42      - 'DirectoryServices.ActiveDirectory'43      - 'NetworkInformation.NetworkInterface'44  selection_conditional:45    CommandLine|contains:46      - ' -eq '47      - ' -ne '48      - ' -match '49      - ' -like '50      - ' -contains '51      - '.Equals('52      - 'if('53      - 'if ('54  condition: selection_environment and selection_conditional55falsepositives:56  - "Configuration management, imaging and login scripts, which are built almost entirely out of this pattern — read the hostname or domain, branch on it, apply the matching policy. This is the dominant source of noise and no field in a process creation event separates it from a guardrail; MITRE's EnvironmentalArtifactList knob is the place to narrow the identity terms to values an attacker would key on rather than ones your own scripts branch on."57  - "Software inventory and licensing agents that query Win32_ComputerSystemProduct for the hardware UUID and compare it against a registered value before continuing."58  - "Health-check and monitoring one-liners that resolve a hostname or enumerate interfaces and test the result before reporting, especially on domain controllers and jump hosts where they run on a schedule."59  - "Administrative PowerShell typed interactively, where a single command line commonly contains both an environment lookup and a comparison operator with no payload behind it at all."60level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "env:COMPUTERNAME" or ProcessCommandLine contains "env:USERDOMAIN" or ProcessCommandLine contains "env:USERDNSDOMAIN" or ProcessCommandLine contains "env:LOGONSERVER" or ProcessCommandLine contains "Win32_ComputerSystem" or ProcessCommandLine contains "Win32_ComputerSystemProduct" or ProcessCommandLine contains "csproduct get uuid" or ProcessCommandLine contains "computersystem get domain" or ProcessCommandLine contains "GetHostByName" or ProcessCommandLine contains "GetIPGlobalProperties" or ProcessCommandLine contains "Get-ADDomain" or ProcessCommandLine contains "DirectoryServices.ActiveDirectory" or ProcessCommandLine contains "NetworkInformation.NetworkInterface") and (ProcessCommandLine contains " -eq " or ProcessCommandLine contains " -ne " or ProcessCommandLine contains " -match " or ProcessCommandLine contains " -like " or ProcessCommandLine contains " -contains " or ProcessCommandLine contains ".Equals(" or ProcessCommandLine contains "if(" or ProcessCommandLine contains "if ("))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*env:COMPUTERNAME*" OR CommandLine="*env:USERDOMAIN*" OR CommandLine="*env:USERDNSDOMAIN*" OR CommandLine="*env:LOGONSERVER*" OR CommandLine="*Win32_ComputerSystem*" OR CommandLine="*Win32_ComputerSystemProduct*" OR CommandLine="*csproduct get uuid*" OR CommandLine="*computersystem get domain*" OR CommandLine="*GetHostByName*" OR CommandLine="*GetIPGlobalProperties*" OR CommandLine="*Get-ADDomain*" OR CommandLine="*DirectoryServices.ActiveDirectory*" OR CommandLine="*NetworkInformation.NetworkInterface*") AND (CommandLine="* -eq *" OR CommandLine="* -ne *" OR CommandLine="* -match *" OR CommandLine="* -like *" OR CommandLine="* -contains *" OR CommandLine="*.Equals(*" OR CommandLine="*if(*" OR CommandLine="*if (*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*env:computername*" OR TO_LOWER(process.command_line) LIKE "*env:userdomain*" OR TO_LOWER(process.command_line) LIKE "*env:userdnsdomain*" OR TO_LOWER(process.command_line) LIKE "*env:logonserver*" OR TO_LOWER(process.command_line) LIKE "*win32_computersystem*" OR TO_LOWER(process.command_line) LIKE "*win32_computersystemproduct*" OR TO_LOWER(process.command_line) LIKE "*csproduct get uuid*" OR TO_LOWER(process.command_line) LIKE "*computersystem get domain*" OR TO_LOWER(process.command_line) LIKE "*gethostbyname*" OR TO_LOWER(process.command_line) LIKE "*getipglobalproperties*" OR TO_LOWER(process.command_line) LIKE "*get-addomain*" OR TO_LOWER(process.command_line) LIKE "*directoryservices.activedirectory*" OR TO_LOWER(process.command_line) LIKE "*networkinformation.networkinterface*") AND (TO_LOWER(process.command_line) LIKE "* -eq *" OR TO_LOWER(process.command_line) LIKE "* -ne *" OR TO_LOWER(process.command_line) LIKE "* -match *" OR TO_LOWER(process.command_line) LIKE "* -like *" OR TO_LOWER(process.command_line) LIKE "* -contains *" OR TO_LOWER(process.command_line) LIKE "*.equals(*" OR TO_LOWER(process.command_line) LIKE "*if(*" OR TO_LOWER(process.command_line) LIKE "*if (*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(env:COMPUTERNAME|env:USERDOMAIN|env:USERDNSDOMAIN|env:LOGONSERVER|Win32_ComputerSystem|Win32_ComputerSystemProduct|csproduct get uuid|computersystem get domain|GetHostByName|GetIPGlobalProperties|Get-ADDomain|DirectoryServices\.ActiveDirectory|NetworkInformation\.NetworkInterface)</field>    <field name="CommandLine" type="pcre2">(?i)( -eq | -ne | -match | -like | -contains |\.Equals\(|if\(|if \()</field>    <description>Environment-keyed conditional execution on the command line</description>    <mitre>      <id>T1480</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ce7e4089-ab36-41ec-828f-22846147096a

ATT&CKT1480

T1480Execution Guardrails

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1480, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Close the batch gap first: add '%COMPUTERNAME%', '%USERDOMAIN%',
Narrow selection_environment toward what an attacker keys on and away from
Know the ceiling: the guardrail is readable only when written inline.
Treat the discovery-burst threshold as downstream work; this rule is one input

Declared by the author

Configuration management, imaging and login scripts, which are built almost entirely out of this pattern — read the hostname or domain, branch on it, apply the matching policy. This is the dominant source of noise and no field in a process creation event separates it from a guardrail; MITRE's EnvironmentalArtifactList knob is the place to narrow the identity terms to values an attacker would key on rather than ones your own scripts branch on.
Software inventory and licensing agents that query Win32_ComputerSystemProduct for the hardware UUID and compare it against a registered value before continuing.
Health-check and monitoring one-liners that resolve a hostname or enumerate interfaces and test the result before reporting, especially on domain controllers and jump hosts where they run on a schedule.
Administrative PowerShell typed interactively, where a single command line commonly contains both an environment lookup and a comparison operator with no payload behind it at all.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

An execution guardrail is a payload that checks where it landed and runs only if the answer matches. AN1551 describes the whole chain — a discovery burst, artefact collection, conditional logic, selective execution, and timing between them. Almost all of that is a threshold over a window, and Sigma has neither counting nor timers. What survives into one event is the shape of the guardrail: a command line that both reads an environment-identifying value and compares it. So this rule requires two independent matches on the same CommandLine field. The AND is the entire idea — an identity lookup alone is T1082 System Information Discovery; a lookup plus a comparison operator is a guardrail.

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN1551, whose Windows source is Security EventID 4688 — which the Sentinel rendering reflects. That means two audit prerequisites, neither on in a default install or in the MS/CIS baselines: Audit Process Creation, and the separate Include command line in process creation events policy. This rule reads only CommandLine; without the second policy the field is empty and the rule matches nothing while looking perfectly healthy. All four backends render.

03 · How the logic works

selection_environment is thirteen CommandLine|contains terms — MITRE's EnvironmentalArtifactList knob, populated here by the author. They group into PowerShell environment-drive reads (env:COMPUTERNAME, env:USERDOMAIN, env:USERDNSDOMAIN, env:LOGONSERVER), WMI/WMIC identity queries (Win32_ComputerSystem, Win32_ComputerSystemProduct, csproduct get uuid, computersystem get domain) and .NET/AD enumeration (GetHostByName, GetIPGlobalProperties, Get-ADDomain, DirectoryServices.ActiveDirectory, NetworkInformation.NetworkInterface). selection_conditional is eight comparison terms. Note the spacing: ' -eq ', ' -ne ', ' -match ', ' -like ', ' -contains ' all carry spaces on both sides, because PowerShell operators are space-delimited and an unspaced -eq would match filenames and switch names. '.Equals(' covers the .NET form; 'if(' and 'if (' are separate because whitespace after if is optional. Two selections over the same field is legitimate Sigma — Wazuh renders it as two pcre2 matches on CommandLine — and it is what buys the discrimination. Note the tag: attack.defense-evasion, taken from the brief's sigmaTactics, not attack.stealth from tactics. ATT&CK v19 split Defense Evasion; Sigma's tag vocabulary did not follow, and attack.stealth resolves to nothing in any Sigma tooling. Note also what is absent: MITRE's DiscoveryActivityThreshold (default 4 activities), DiscoveryTimeWindow (300 s) and ExecutionDelayBaseline are counting and timing knobs with no Sigma construct behind them. They were left out rather than faked.

04 · Common false positives

Continuously, and the rule's own false positives say so. Configuration management, imaging and login scripts are built out of this exact pattern, and no field in a process-creation event separates them from a guardrail. The reviewer named the biggest omission: Intune Win32 app detection scripts and SCCM configuration items, which are literally "read an environment value, compare it, exit 0 or 1" and — unlike imaging scripts, which run once — run on a schedule for every assigned app on every device.
There is a quieter miss. The rule only speaks PowerShell. Trace cmd /c if "%COMPUTERNAME%"=="FIN-DC01" start payload.exe: selection_environment has env:COMPUTERNAME but not %COMPUTERNAME%, and selection_conditional has no == and no bare if " — the 'if (' term needs a parenthesis batch does not use. Neither selection matches. The most common way an environment key is written on Windows walks straight past this rule, and [Environment]::MachineName and hostname-output comparisons go with it.
Finally, the shape is identical to T1497 Virtualization/Sandbox Evasion. A guardrail expects a specific target value; sandbox evasion rejects known sandbox values. Only the compared literal separates them, and reading it takes a human.

05 · Detection maturity

tier_1: . Authored from a MITRE scaffold that ships prose, log sources and knobs and no query logic, and never run against real data. The two-selection design is the right idea for a technique with no single-event signature, but as written it is closer to an inventory of a common scripting idiom than to a detection.
tier_2: confirm the command-line audit policy is on, then run the selections read-only and count how much volume is Intune/SCCM detection scripts. If that is most of it — expect it to be — the rule belongs in a hunt queue until the identity terms are narrowed.
tier_3: ** add the batch forms, move the encoded and file-based cases to a 4104 companion, and implement MITRE's threshold in the correlation layer so the alert fires on the chain rather than on one line.

Share this rule

/u/siemphony/ce7e4089-ab36-41ec-828f-22846147096a

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Environment-keyed conditional execution on the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it