Potential File Override/Append Via SET Command
Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign, often used with an append redirection operator ">>" to update file content indirectly. This technique can be used by attackers to append data to files, as demonstrated by the example: `cmd /c >> example.txt set /p="test data"` which appends "test data" to "example.txt". The rule specifically looks for `cmd.exe` executions containing `/c set /p=` or `"set /p=` or `>>*set /p=` in the command line.
Sigma
