CMD Shell Output Redirection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects the use of the redirection character ">" in command-line arguments of `cmd.exe`. This technique is often used by malicious actors to redirect the output of reconnaissance commands (e.g., `hostname`, `dir`) to files for later exfiltration.