Lesson 2 of 9 · 25m

Command Lines and Process Trees: Where the Truth Lives

Modern malware runs signed Microsoft binaries. The maliciousness lives in the arguments and the parent process.

The binary your attacker just ran is rundll32.exe — signed by Microsoft, blessed by every allowlist. The part that's actually malicious is the command line and who spawned it. Detection engineering on Windows is, more than anything, the art of reading process trees.

The fields that matter

In a Sysmon EID 1 (or 4688 with command lines on), these fields do the work:

Image / CommandLine — the binary and its arguments
ParentImage / ParentCommandLine — who launched it
User, IntegrityLevel — context: SYSTEM service or a user who just opened a doc
Hashes, ProcessGuid — pivot material and reliable parent/child joins

Parent-child is the durable signal

winword.exe spawning powershell.exe is never legitimate. Neither is excel.exe spawning cmd.exe, mshta.exe spawning anything, or explorer.exe spawning wmic.exe with a remote node: argument. Office → script interpreter is the macro-malice kill chain (T1204.002 delivery into T1059.001 execution), and it survives every re-compile of the payload because the relationship is the tell, not the file.

Attackers know filename matching is cheap, so they rename payload.exe to svchost.exe and run it from C:\ProgramData. Counter it with path checks: powershell.exe executing from anywhere but C:\Windows\System32\WindowsPowerShell\v1.0\ (or SysWOW64 for the 32-bit copy) is masquerading — ATT&CK T1036.

Command lines are written to evade you

PowerShell accepts any unambiguous parameter prefix, so -encodedcommand legitimately arrives as -enc, -en, -ec, -encodedc. A rule matching only -encodedcommand is already bypassed. Match the family:

(?i)powershell.*\s-(e|ec|en|enc|enco|encodedcommand)

CMD adds its own tricks: caret insertion (p^o^w^e^r^s^h^e^l^l), stray quotes, case mixing. Normalize before you match — lowercase, strip ^, collapse whitespace — or write the pattern against normalized fields your pipeline provides.

Try this

For each of rundll32, regsvr32, mshta, certutil, and bitsadmin, write one line: a legitimate parent/context and a suspicious one. bitsadmin run by Windows Update under SYSTEM with /transfer jobs is normal; bitsadmin run by powershell.exe under a user pulling from a raw IP is T1197. If you can't name the difference, your rules will either miss it or alert on Patch Tuesday.

Field notes

A detection on mimikatz.exe dies the moment it's renamed to notepad.exe. The durable version: Sysmon EID 10 where TargetImage ends in lsass.exe and GrantedAccess is 0x1010 or 0x1410 — that's the behavior, regardless of what the tool calls itself.
Logon type and integrity level turn a maybe into a call. powershell -enc run by an admin on their workstation during a change window is Tuesday; the same string under a service account that has never run PowerShell is an incident.