Suspicious CMD Execution with Delayed Expansion Disabled

Kaung Khant Ko@kaungkhantko

•updated Jul 24, 2026•4•0•7

Detects the execution of cmd.exe with specific command-line arguments (/e:ON /v:OFF /d /c) that disable delayed expansion and autoloading of auto-run commands. This configuration is often used by adversaries to execute malicious payloads while bypassing certain environment checks or security controls that rely on command shell defaults.