Suspicious Arguments

Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better [blend in](https://attack.mitre.org/tactics/TA0005) with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters. Any tool of interest with commonly known command line usage can be detecting by command line analysis. Known substrings of command lines include - PuTTY - port forwarding `-R * -pw` - secure copy (scp) `-pw * * *@*` - mimikatz `sekurlsa::` - RAR `* -hp *` - Archive`* a *` Additionally, it may be useful to find IP addresses in the command line - `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}` Logically this analytic makes use of [CAR-2014-03-005](../CAR-2014-03-005).