Console CodePage Lookup Via CHCP

Hunt Hypothesis

Detects use of chcp to look up the system locale value as part of host discovery

Detection Rule

Sigma (Original)

title: Console CodePage Lookup Via CHCP
id: 7090adee-82e2-4269-bd59-80691e7c6338
status: test
description: Detects use of chcp to look up the system locale value as part of host discovery
references:
    - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
author: _pete_0, TheDFIRReport
date: 2022-02-21
modified: 2024-03-05
tags:
    - attack.discovery
    - attack.t1614.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|contains|windash:
            - ' -c '
            - ' -r '
            - ' -k '
        Image|endswith: '\chcp.com'
        CommandLine|endswith:
            - 'chcp'
            - 'chcp '
            - 'chcp  '
    condition: selection
falsepositives:
    - During Anaconda update the 'conda.exe' process will eventually execution the 'chcp' command.
    - Discord was seen using chcp to look up code pages
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup/info.yml

KQL (Azure Sentinel)

imProcessCreate
| where (ParentProcessName endswith "\\cmd.exe" or ActingProcessName endswith "\\cmd.exe") and (ActingProcessCommandLine contains " -c " or ActingProcessCommandLine contains " /c " or ActingProcessCommandLine contains " –c " or ActingProcessCommandLine contains " —c " or ActingProcessCommandLine contains " ―c " or ActingProcessCommandLine contains " -r " or ActingProcessCommandLine contains " /r " or ActingProcessCommandLine contains " –r " or ActingProcessCommandLine contains " —r " or ActingProcessCommandLine contains " ―r " or ActingProcessCommandLine contains " -k " or ActingProcessCommandLine contains " /k " or ActingProcessCommandLine contains " –k " or ActingProcessCommandLine contains " —k " or ActingProcessCommandLine contains " ―k ") and TargetProcessName endswith "\\chcp.com" and (TargetProcessCommandLine endswith "chcp" or TargetProcessCommandLine endswith "chcp " or TargetProcessCommandLine endswith "chcp  ")

Required Data Sources

False Positive Guidance

• During Anaconda update the ‘conda.exe’ process will eventually execution the ‘chcp’ command.
• Discord was seen using chcp to look up code pages

MITRE ATT&CK Context

• Tactic: Discovery
• Technique: T1614.001 — T1614.001

References

• https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
• SigmaHQ Rule