Cmd.EXE Missing Space Characters Execution Anomaly

Title: Cmd.EXE Missing Space Characters Execution Anomaly
Status: test
Description:Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).
References:
  -https://twitter.com/cyb3rops/status/1562072617552678912
  -https://ss64.com/nt/cmd.html
Author: Florian Roth (Nextron Systems)
Date: 2022-08-23
modified:2026-05-13
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection1:
    CommandLine|contains:
      -'cmd.exe/c'
      -'\cmd/c'
      -'"cmd/c'
      -'cmd.exe/k'
      -'\cmd/k'
      -'"cmd/k'
      -'cmd.exe/r'
      -'\cmd/r'
      -'"cmd/r'

  selection2:
    CommandLine|contains:
      -'/cwhoami'
      -'/cpowershell'
      -'/cschtasks'
      -'/cbitsadmin'
      -'/ccertutil'
      -'/kwhoami'
      -'/kpowershell'
      -'/kschtasks'
      -'/kbitsadmin'
      -'/kcertutil'

  selection3:
    CommandLine|contains:
      -'cmd.exe /c'
      -'cmd /c'
      -'cmd.exe /k'
      -'cmd /k'
      -'cmd.exe /r'
      -'cmd /r'

  filter_generic:
    CommandLine|contains:
      -'cmd.exe /c '
      -'cmd /c '
      -'cmd.exe /k '
      -'cmd /k '
      -'cmd.exe /r '
      -'cmd /r '

  filter_fp:
CommandLine|contains:'AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules' CommandLine|endswith:'cmd.exe/c .' CommandLine:'cmd.exe /c' CommandLine:'cmd /c'   condition:1 of selection* and not 1 of filter_*
Falsepositives:
  -Legitimate use of cmd.exe with no arguments e.g. via system("") in C to enable ANSI escape codes
Level: high