Potential Command Line Path Traversal Evasion Attempt
This rule detects potential evasion or obfuscation attempts by identifying command lines that use bogus path traversal. Specifically, it looks for patterns like '\\..\\Windows\\', '\\..\\System32\\', or '\\..\\..\\' within the command line of processes whose image path contains '\\Windows\\'. It also flags command lines containing '.exe\\..\\' which could indicate an attempt to manipulate execution paths. The rule includes filters for known legitimate applications like Google Drive and Citrix that might exhibit similar behavior.
Sigma
