Suspicious CMD Input Redirection from Local File
Detects cmd.exe execution using /c or /k with input redirection ("<") from a file, which is commonly abused to execute staged payloads, scripts, or configuration files without directly invoking them.
Sigma
