Potential Arbitrary File Download Via Cmdl32.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the execution of `Cmdl32.exe` with the `/vpn` and `/lan` flags. Attackers can abuse this legitimate Windows utility to download arbitrary files by providing a malicious configuration file. The rule advises inspecting the location and content of the file passed as an argument to determine if it is suspicious.