EchoCreep Executes a Decrypted Shell Task

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•5

Detects `cmd.exe` spawned by a Discord-enabled backdoor after command decoding rather than by an interactive user or administrative tool. The rule specifically looks for `cmd.exe` executing commands (`/c`) where the parent process is identified as `searchapp.exe`, `echocreep.exe`, `service.exe`, or `update.exe`.