ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset

Hunt Hypothesis

This detection identifies instances where a cmd.exe process is executed by an application named “ReactOS,” which may indicate legitimate software packaging or the deployment of adversary tools masquerading as system utilities to establish persistence. A proactive hunt for this behavior in Azure Sentinel is essential because low-severity signals involving custom-named command shells often represent early-stage reconnaissance or living-off-the-land tactics that could evolve into more critical threats if left uninvestigated.

YARA Rule

rule ReactOS_cmd_valid {
	meta:
		description = "ReactOS cmd.exe with correct file name - maybe packed with software or part of hacker toolset"
		author = "Florian Roth"
		date = "05.11.14"
		reference = "http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php"
		score = 30
		hash = "b88f050fa69d85af3ff99af90a157435296cbb6e"
	strings:
		$s1 = "ReactOS Command Processor" fullword wide
		$s2 = "Copyright (C) 1994-1998 Tim Norman and others" fullword wide
		$s3 = "Eric Kohl and others" fullword wide
		$s4 = "ReactOS Operating System" fullword wide
	condition:
		all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

• http://www.elifulkerson.com/articles/suzy-sells-cmd-shells.php
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ReactOS cmd.exe detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Maintenance via PowerShell Wrapper

  • Context: Enterprise IT teams often use cmd.exe as a launcher for scheduled maintenance scripts (e.g., disk cleanup or log rotation) that are triggered by Task Scheduler. In these cases, the parent process is usually svchost.exe (Task Scheduler service), and the command line includes standard administrative flags rather than interactive user input.
  • Suggested Filter/Exclusion: Exclude events where the parent process name is svchost.exe AND the command line contains specific maintenance keywords like /c, cleanmgr, or paths pointing to a dedicated maintenance directory (e.g., C:\Windows\System32\Tasks\Maintenance).

• Scenario: Deployment of Software via MSI Installer

  • Context: During software updates, deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune often invoke cmd.exe to execute silent installation commands (msiexec /i ...) or run post-installation scripts. These instances are legitimate and expected during change windows.
  • Suggested Filter/Exclusion: Create an exclusion for cmd.exe processes where the command line argument contains msiexec, setup.exe, or specific vendor identifiers (e.g., /qn, /quiet) and the parent process is a known deployment agent like ccmexec.exe or Microsoft.Intune.Agent.

• Scenario: Automated Backup Jobs via Third-Party Tools

  • Context: Legacy backup solutions such as Veeam, Acronis Cyber Protect, or Veritas NetBackup frequently utilize a local cmd.exe instance to execute batch files that trigger the actual backup engine. These jobs often run during off