Analytics BIOC
Low
✕
Command running with COMSPEC in the command line argument
COMSPEC is an environmental variable that points to cmd.exe. Attackers may use this command to obfuscate their command and avoid detection.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: Windows Command Shell (T1059.003)
Attacker's goals:
Attackers might use environment variables to try and avoid being detected and obfuscate their commands.
Investigative actions:
Investigate the actor and the command line that executed with COMSPEC Verify that the command executed from a trusted source.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day