Potentially Suspicious CMD Shell Output Redirect

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.