Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows Command Obfuscation with Environment Variable Substrings

Detects command obfuscation by using a technique to build a target command using character indexes from environment variables. This hides the true intent of the command by building it on the fly. In Windows command prompt, you can use the :~ format to extract substrings from environment variable values. This behavior has been observed in various malware families, including Cobalt Strike and Meterpreter.

ATT&CK coverage

Outside the enterprise matrix

T1027.010Command Obfuscation 33 detections cover this technique

Detection requirements

Log source category: crowdstrike_processrollup2 sysmon_eventid_1 windows_event_log_security_4688

What the source says

What fires this without an attack behind it

Some legitimate scripts and system maintenance tools may use substring extraction from environment variables for dynamic command construction. Review and whitelist authorized scripts to reduce false positives.

Tagged by the source as

Malicious PowerShellEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.