Batch file run by the command shell from a user-writable path

Siemphony@siemphonylowT1059.003unverified

AN0578 asks for interactive or scripted abuse of cmd.exe and batch files, but the bare observable — the command shell started — happens thousands of times a day on a healthy host, so this rule keeps MITRE's ScriptStoragePath knob and drops the rest: cmd.exe running a .bat or .cmd whose path sits in a staging directory any unprivileged account can write to, populated here with the per-user and Windows temp directories, roaming AppData, the public profile, Downloads, %ProgramData% and the recycle bin. The ParentProcessName knob MITRE names alongside it — cmd.exe spawned by a document viewer or browser — is deliberately not written, because the corpus already carries that lineage under T1204 and T1203 and a third copy would add no coverage; the CommandLinePattern knob is left out because chaining operators and `/c` are as common in vendor install scripts as in an implant. The brief offers Security EventID 4688 for this analytic but maps it onto the Sysmon-shaped `process_creation` category, and the rule is written in that vocabulary (`Image`, `CommandLine`): a 4688 feed needs `NewProcessName` mapped onto `Image` and `ProcessCommandLine` onto `CommandLine` before it can match at all, and 4688 itself requires *Audit Process Creation* plus the separate *Include command line in process creation events* policy, neither of which is on in a default install or in the MS/CIS baselines. AN0578's second log source, the Sysmon EventID 7 module load, is not used here. Two limits of the shape: the script name and the staging directory are independent substrings of the same `CommandLine`, so the rule does not actually assert that the batch file is the thing sitting in the writable path, and a batch file invoked by bare name from a working directory already set to that path puts no directory on the command line at all and is missed — on a Sysmon feed `CurrentDirectory` would close that gap, on a 4688 feed nothing does. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0202, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\cmd.exe" and (ProcessCommandLine contains ".bat" or ProcessCommandLine contains ".cmd")) and (ProcessCommandLine contains "\\AppData\\Local\\Temp\\" or ProcessCommandLine contains "\\AppData\\Roaming\\" or ProcessCommandLine contains "\\Windows\\Temp\\" or ProcessCommandLine contains "\\Users\\Public\\" or ProcessCommandLine contains "\\Downloads\\" or ProcessCommandLine contains "\\ProgramData\\" or ProcessCommandLine contains "\\$Recycle.Bin\\"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\cmd.exe" AND (CommandLine="*.bat*" OR CommandLine="*.cmd*")) AND (CommandLine="*\\AppData\\Local\\Temp\\*" OR CommandLine="*\\AppData\\Roaming\\*" OR CommandLine="*\\Windows\\Temp\\*" OR CommandLine="*\\Users\\Public\\*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\ProgramData\\*" OR CommandLine="*\\$Recycle.Bin\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" AND (TO_LOWER(process.command_line) LIKE "*.bat*" OR TO_LOWER(process.command_line) LIKE "*.cmd*")) AND (TO_LOWER(process.command_line) LIKE "*\\\\appdata\\\\local\\\\temp\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\appdata\\\\roaming\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\windows\\\\temp\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\users\\\\public\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\downloads\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\programdata\\\\*" OR TO_LOWER(process.command_line) LIKE "*\\\\$recycle.bin\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\cmd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(\.bat|\.cmd)</field>    <field name="CommandLine" type="pcre2">(?i)(\\AppData\\Local\\Temp\\|\\AppData\\Roaming\\|\\Windows\\Temp\\|\\Users\\Public\\|\\Downloads\\|\\ProgramData\\|\\\$Recycle\.Bin\\)</field>    <description>Batch file run by the command shell from a user-writable path</description>    <mitre>      <id>T1059.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8ce47038-ef50-40e1-ab92-98e0b623982d

ATT&CKT1059.003

T1059.003Windows Command Shell

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonscript interpreter execution

script interpreter executionAI draft — unreviewed

01 · What this rule detects

cmd.exe running a batch file out of a directory any unprivileged account can write to. AN0578 asks broadly for "interactive or scripted abuse of cmd.exe", but the bare observable — the command shell started — happens thousands of times a day on a healthy host and is worthless as an alert. So this rule keeps one of MITRE's knobs, ScriptStoragePath, and drops the rest. The behaviour it is aimed at is the staging step: a payload dropped into %TEMP% or Downloads and then handed to the shell.

02 · Telemetry you need

category: process_creation, product: windows, copied from the brief. The rule is written in the Sysmon EventID 1 vocabulary — Image, CommandLine. The brief also offers Security EventID 4688 for this analytic and maps it onto the same Sysmon-shaped category, but that feed is not interchangeable: 4688 carries NewProcessName and ProcessCommandLine, which must be mapped onto Image and CommandLine before a single selection here can match. On top of that, 4688 needs Audit Process Creation enabled, and its command line needs the separate Include command line in process creation events policy — neither is on in a default install or in the MS/CIS baselines, and without the second one every selection in this rule is dead.

03 · How the logic works

Three selections, all required. selection_shell matches Image|endswith: '\cmd.exe'. selection_script requires .bat or .cmd anywhere in the command line. selection_staging_path requires one of seven user-writable directory fragments: the per-user and Windows temp directories, roaming AppData, the public profile, Downloads, %ProgramData% and the recycle bin. That path list is populated by this pipeline; MITRE names the knob, not the values. Two limits are worth internalising. The script extension and the staging directory are independent substrings of the same CommandLine, so the rule never actually asserts that the batch file is the thing sitting in the writable path — cmd /c script.bat > C:\Users\Public\out.log matches. And a batch file invoked by bare name from a working directory already set to that path puts no directory on the command line at all and is missed; on a Sysmon feed CurrentDirectory would close that gap, on 4688 nothing does. MITRE's ParentProcessName knob is deliberately unused — that lineage is already covered in this corpus under T1203 and T1204.

04 · Common false positives

Constantly, which is why the rule is scored low. Installers, updaters and self-extracting archives unpack a .bat wrapper into temp and hand it to cmd.exe by design; MSI custom actions do this routinely and are probably the largest single source of matches on any fleet. RMM and endpoint-management platforms stage remediation and inventory scripts under %ProgramData% before invoking them. Logon and imaging automation keeps batch files in the public profile. Developers and IT staff run downloaded setup scripts straight out of Downloads.

05 · Detection maturity

tier_1: Lowest tier, and honestly so. This rule was derived from MITRE prose and has never been executed against a log line. Nothing here is validated: not the path list, not the claim about which false positive dominates, not the low rating. Run it as a hunt query first and let your own data set the level.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Do not tune by removing paths — you would delete exactly where payloads land. Tune by parent and by signer instead. Exclude msiexec.exe, your RMM agent and your imaging task-sequence host as ParentImage values, and pin them by full path so a dropped lookalike does not inherit the exclusion. Then narrow the extension test toward a real filename shape, and if you have Sysmon, add CurrentDirectory to recover the bare-name invocation the current rule misses.

Declared by the author

Installers, updaters and self-extracting archives that unpack a .bat or .cmd wrapper into the user or Windows temp directory and hand it to cmd.exe — MSI custom actions and vendor bootstrappers do this by design, and it is likely the largest single source of matches on a typical fleet.
Endpoint-management and RMM platforms that stage remediation, inventory or detection scripts under %ProgramData% or the Windows temp directory before invoking them, which is the normal deployment path for configuration-management agents.
Logon, imaging and build automation that keeps its batch files in the public profile so every account on a shared workstation, lab machine or kiosk can reach them.
IT staff and developers running a downloaded setup or build script straight out of the Downloads folder, which produces the same shell-plus-user-writable-path event as a staged payload.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Windows command shell (Ryuk)
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/8ce47038-ef50-40e1-ab92-98e0b623982d

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Batch file run by the command shell from a user-writable path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it