This rule identifies processes that have a console window attached, which is often indicative of interactive command-line activity or manual execution by an adversary rather than automated background tasks. Proactively hunting for these instances helps the SOC team distinguish between legitimate administrative actions and potential hands-on-keyboard activity that may signal initial access or lateral movement within the Azure environment.
rule IsConsole : PECheck
{
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint16(uint32(0x3C)+0x5C) == 0x0003
}This YARA rule can be deployed in the following contexts:
Windows Server Update Services (WSUS) or Patch Tuesday Maintenance: System administrators often run wusa.exe or wmic commands directly from an interactive console session to verify patch compliance or force specific updates on a subset of servers. This legitimate administrative task triggers the IsConsole flag because the process is attached to an active terminal window.
explorer.exe or cmd.exe and the command line contains specific keywords like /verify, /quiet, or /norestart, or restrict the rule to only trigger if the console process is not a known system utility (e.g., wusa.exe, wmic.exe, powershell.exe with -NoProfile).Scheduled Task Execution with Interactive User Context: Many enterprise scheduled tasks (e.g., log rotation, backup verification, or compliance checks) are configured to run “only if user is logged on” to access user-specific resources. When these tasks execute, they may spawn child processes that inherit the console handle of the logged-on user’s session, even if the task itself is automated.
svchost.exe (specifically the Tasks service) or Taskeng.exe, or filter out any process where the CreationTime aligns with a known scheduled task execution window and the parent chain includes Taskeng.exe.Developer or DBA Interactive Query Sessions: Database administrators (DBAs) or developers frequently use tools like sqlcmd.exe, psql.exe, or mysql.exe from a console to run ad-hoc queries, verify schema changes, or troubleshoot performance issues. These are legitimate, high-privilege interactive sessions that inherently require a console.