Suspicious CodePage Switch Via CHCP

Hunt Hypothesis

Detects a code page switch in command line or batch scripts to a rare language

Detection Rule

Sigma (Original)

title: Suspicious CodePage Switch Via CHCP
id: c7942406-33dd-4377-a564-0f62db0593a3
status: test
description: Detects a code page switch in command line or batch scripts to a rare language
references:
    - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
    - https://twitter.com/cglyer/status/1183756892952248325
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
date: 2019-10-14
modified: 2023-03-07
tags:
    - attack.stealth
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\chcp.com'
        CommandLine|endswith:
            - ' 936'    # Chinese
            # - ' 1256' # Arabic
            - ' 1258'   # Vietnamese
            # - ' 855'  # Russian
            # - ' 866'  # Russian
            # - ' 864'  # Arabic
    condition: selection
falsepositives:
    - Administrative activity (adjust code pages according to your organization's region)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch/info.yml

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessName endswith "\\chcp.com" and (TargetProcessCommandLine endswith " 936" or TargetProcessCommandLine endswith " 1258")

Required Data Sources

False Positive Guidance

• Administrative activity (adjust code pages according to your organization’s region)

MITRE ATT&CK Context

• Technique: T1036 — T1036

References

• https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
• https://twitter.com/cglyer/status/1183756892952248325
• SigmaHQ Rule