Suspicious CodePage Switch Via CHCP

Title: Suspicious CodePage Switch Via CHCP
Status: test
Description:Detects a code page switch in command line or batch scripts to a rare language
References:
  -https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  -https://twitter.com/cglyer/status/1183756892952248325
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2019-10-14
modified:2023-03-07
Tags:

• -'attack.stealth'
• -'attack.t1036'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\chcp.com'
    CommandLine|endswith:
      -' 936'
      -' 1258'

  condition:selection
Falsepositives:
  -Administrative activity (adjust code pages according to your organization's region)
Level: medium