Suspicious Command-Line Activity with System Binaries

nomit vyas@xoxo

•updated Jun 22, 2026•1•0•3

Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) when they contain keywords indicative of network communication or data transfer (http, https, base64, /transfer). This pattern is often observed in malware or adversary techniques to download payloads, exfiltrate data, or execute remote code.