Potential CommandLine Path Traversal Via Cmd.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•16

Detects potential path traversal attempts via cmd.exe, which could indicate command or argument confusion/hijacking. The rule looks for cmd.exe being executed with command line arguments containing '/c', '/k', or '/r' and a path traversal sequence like '/../../'.