Cmd Launched with Hidden Start Flags to Suspicious Targets

Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)

Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories. This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.

2026-01-24 00:00:00

None

5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d

attack.defense-evasion attack.t1564.003

Community Rule

Vladan Sekulic

Merge PR #5767 from @vl43den - Add `Cmd Launched with Hidden Start Flags to Suspicious Targets`

2026-01-26