Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1059.003

Windows Command Shell

Execution 108 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Suspicious Command Execution from Visual Studio Code production 2026-10-26
elastic Web Shell Detection: Script Process Child of Common Web Processes production 2026-10-23
sigma AppLocker Application Would Have Been Blocked experimental 2026-10-20
elastic Proxy Execution via Console Window Host production 2026-10-09
splunk Windows Suspicious React or Next.js Child Process production 2026-10-09
elastic Suspicious React Server Child Process production 2026-10-09
splunk Windows For Loop Usage Within Cmd.exe To Execute Commands production 2026-10-09
splunk Windows Command Shell DCRat ForkBomb Payload production 2026-10-09
elastic Suspicious SolarWinds Web Help Desk Java Module Load or Child Process production 2026-10-09
elastic Suspicious Windows Command Shell Arguments production 2026-10-09
elastic Suspicious Microsoft HTML Application Child Process production 2026-10-09
elastic Potential Prompt Injection Coercing Shell Execution production 2026-10-09
elastic Command Execution via SolarWinds Process production 2026-10-06
elastic Execution via MSSQL xp_cmdshell Stored Procedure production 2026-10-05
elastic Potential FileFix Command via Windows Explorer Address Bar production 2026-10-05
elastic Potential ClickFix Command via Windows Run Dialog production 2026-10-05
splunk Windows SQLCMD Execution production 2026-10-02
elastic Potential Execution via FileFix Phishing Attack production 2026-09-28
elastic Execution via OpenClaw Agent production 2026-09-25
elastic Execution of a Downloaded Windows Script production 2026-09-18
elastic Potential Fake CAPTCHA Phishing Attack production 2026-09-18
elastic Process Activity via Compiled HTML File production 2026-09-18
elastic Suspicious Cmd Execution via WMI production 2026-09-18
elastic Potential Command Shell via NetCat production 2026-09-18
elastic Command and Scripting Interpreter via Windows Scripts production 2026-09-18
elastic Execution from Unusual Directory - Command Line production 2026-09-18
elastic Command Shell Activity Started via RunDLL32 production 2026-09-18
elastic Suspicious Command Prompt Network Connection production 2026-09-18
elastic Suspicious Child Process via Azure VM CustomScript Extension production 2026-09-18
elastic Suspicious Zoom Child Process production 2026-09-18
elastic Delayed Execution via Ping production 2026-09-18
elastic Suspicious Execution from a Mounted Device production 2026-09-18
elastic Microsoft Build Engine Started by a Script Process production 2026-09-18
elastic Potential SAP NetWeaver Exploitation production 2026-09-18
elastic Execution via GitHub Actions Runner production 2026-09-18
elastic Suspicious ScreenConnect Client Child Process production 2026-09-18
elastic Suspicious Shell Execution via Velociraptor production 2026-09-18
elastic Service Control Spawned via Script Interpreter production 2026-09-18
elastic System Shells via Services production 2026-09-18
elastic Potential SharpRDP Behavior production 2026-09-18
elastic ScreenConnect Server Spawning Suspicious Processes production 2026-09-18
elastic Suspicious Explorer Child Process production 2026-09-18
elastic Windows Server Update Service Spawning Suspicious Processes production 2026-09-18
elastic Suspicious MS Outlook Child Process production 2026-09-18
elastic Suspicious MS Office Child Process production 2026-09-18
elastic Microsoft Exchange Worker Spawning Suspicious Processes production 2026-09-18
elastic Suspicious Execution from VS Code Extension production 2026-09-18
elastic Suspicious Child Process of PaperCut Server Component production 2026-09-18
elastic Suspicious JetBrains TeamCity Child Process production 2026-09-18
splunk CrushFTP Authentication Bypass Exploitation production 2026-09-08
splunk Windows Content Copied from Browser was Executed production 2026-09-07
splunk Windows TinyCC Shellcode Execution production 2026-09-01
splunk Windows PowerShell FakeCAPTCHA Clipboard Execution production 2026-07-14
splunk Windows PowerShell Invoke-Sqlcmd Execution production 2026-05-13
splunk CMD Carry Out String Command Parameter production 2026-05-13
splunk CMD Echo Pipe - Escalation production 2026-05-13
splunk Detect Prohibited Applications Spawning cmd exe production 2026-05-13
splunk Detect Use of cmd exe to Launch Script Interpreters production 2026-05-13
splunk Ryuk Wake on LAN Command production 2026-05-13
splunk Windows File Association Modification via Ftype production 2026-05-13
splunk Windows Powershell History File Deletion production 2026-05-13
splunk Windows Shell Process from CrushFTP production 2026-05-13
sigma Axios NPM Compromise Indicators - Windows experimental 2026-04-01
sigma OpenEDR Spawning Command Shell experimental 2026-02-19
sigma AppLocker Prevented Application or Script from Running test 2025-12-03
sigma Network Connection Initiated via Finger.EXE experimental 2025-11-19
sigma DNS Query by Finger Utility experimental 2025-11-19
sigma Suspicious Usage of For Loop with Recursive Directory Search in CMD experimental 2025-11-12
sigma Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) experimental 2025-08-01
sigma Suspicious Child Process of SAP NetWeaver - Linux experimental 2025-04-28
sigma Potential SAP NetWeaver Webshell Creation experimental 2025-04-28
sigma Potential SAP NetWeaver Webshell Creation - Linux experimental 2025-04-28
sigma Suspicious Child Process of SAP NetWeaver experimental 2025-04-28
sigma Suspicious Process Spawned by CentreStack Portal AppPool experimental 2025-04-17
sigma Suspicious CrushFTP Child Process experimental 2025-04-10
sigma Potential APT FIN7 Exploitation Activity test 2024-07-29
sigma Powershell Executed From Headless ConHost Process test 2024-07-23
sigma Headless Process Launched Via Conhost.EXE test 2024-07-23
sigma Remote Access Tool - ScreenConnect Remote Command Execution test 2024-02-26
sigma Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE test 2024-01-02
sigma HackTool - CrackMapExec Execution Patterns stable 2023-11-06
sigma Remote Access Tool - ScreenConnect Temporary File test 2023-10-10
sigma Remote Access Tool - ScreenConnect File Transfer test 2023-10-10
sigma Remote Access Tool - ScreenConnect Command Execution test 2023-10-10
sigma Sofacy Trojan Loader Activity test 2023-05-31
sigma Rorschach Ransomware Execution Activity test 2023-04-22
sigma Suspicious HH.EXE Execution test 2023-04-12
sigma HTML Help HH.EXE Suspicious Child Process test 2023-04-12
sigma Elise Backdoor Activity test 2023-03-09
sigma Potential Baby Shark Malware Activity test 2023-03-08
sigma HackTool - CrackMapExec Execution test 2023-03-08
sigma Read Contents From Stdin Via Cmd.EXE test 2023-03-07
sigma Potential CommandLine Path Traversal Via Cmd.EXE test 2023-03-06
sigma HackTool - RedMimicry Winnti Playbook Execution test 2023-03-01
sigma HackTool - Jlaive In-Memory Assembly Execution test 2023-02-22
sigma PUA - AdvancedRun Execution test 2023-02-21
sigma HackTool - Koadic Execution test 2023-02-11
sigma Operator Bloopers Cobalt Strike Commands test 2023-01-30
sigma Operator Bloopers Cobalt Strike Modules test 2023-01-30
sigma Exploited CVE-2020-10189 Zoho ManageEngine test 2023-01-21
sigma Conhost.exe CommandLine Path Traversal test 2022-06-14
sigma AWS EC2 Startup Shell Script Change test 2022-06-07
sigma Powershell Execute Batch Script test 2022-01-02
sigma Suspicious HWP Sub Processes test 2021-11-27
sigma ZxShell Malware test 2021-11-27
sigma Exploiting SetupComplete.cmd CVE-2019-1378 test 2021-11-27
sigma Command Line Execution with Suspicious URL and AppData Strings test 2021-11-27
sentinel Exchange Worker Process Making Remote Call Scheduled —