Rule Content
- title: Suspicious Code Page Switch
id: c7942406-33dd-4377-a564-0f62db0593a3
status: experimental
description: Detects a code page switch in command line or batch scripts to a rare
language
author: Florian Roth
date: 2019/10/14
references:
- https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
- https://twitter.com/cglyer/status/1183756892952248325
logsource:
category: process_creation
product: windows
service: null
detection:
selection:
CommandLine:
- chcp* 936
- chcp* 1258
condition: selection
fields:
- ParentCommandLine
falsepositives:
- Administrative activity (adjust code pages according to your organisation's region)
level: medium