Odd Command Lines

Red Flags

The command line is what a process was told to do. Windows gives its own processes the arguments they expect, so a service host, svchost.exe, always names the group of services it runs. SigmaHQ calls a service host with no arguments extremely abnormal, because with nothing to host it is either a likely home for injected code or not a service host at all. An encoded command or a hidden window often conceals what runs, though management tools use both too. Read the command line from the creation record first, then from the running process, since the two can differ.

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

Normal

A clean Windows 11 install

The DCOM launcher's service host on a clean install, naming its group.
NameParentCommand Line
svchost.exeservices.exesvchost.exe -k DcomLaunch -p
See It in the Window

Suspicious

ws-042,

The misnamed service host on ws-042 at 10:07 on 12 Oct 2026.
NameParentCommand Line
scvhost.exeupdsvc64.exeC:\Windows\Temp\scvhost.exe
Command LineNo arguments after its path: a genuine svchost.exe names the service group it loads with -k. Odd Command Lines
See It in the Window

Look Inside

Why It Matters

The command line says what a process was told to do, so a hidden or encoded one is a sign in itself. A service host or proxy started with no arguments has nothing to run, which published rules read as a likely home for injected code.

How to Confirm It

Work through these in order. Each step names the page that shows how.

  1. Read the command line from the creation record, in event 4688 in the Security log with its command line policy, Sysmon event 1 or DeviceProcessEvents. It shows how the process was started.Command Line and Environment
  2. Read it again from the running process or a memory image, with Win32_Process or windows.cmdline. A difference means it was rewritten after start.Command Line and Environment
  3. Decode an encoded command, and never run it. Event 4104 in the Microsoft-Windows-PowerShell/Operational log, where script block logging is on, records what PowerShell actually ran.Command Line and Environment
  4. Follow the parent, because a hidden or encoded command from an Office program, a script host or explorer.exe at sign-in points to a document, a script or a Run key.Process Trees and Call Chains

What Defenders See

Each record names its log and what must be switched on to get it.

Record and Where It LandsWhat to ReadHow to Turn It On
4688 A new process has been created (opens in a new tab)SecurityIt is written on the computer the process ran on.Process Command Line, which stays empty unless Include command line in process creation events is on.Process Trees and Call Chains shows how to read it.Turn on Audit Process Creation. For the command line, also turn on Include command line in process creation events.
1 Process creation (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon.CommandLine and ParentCommandLine for every start, whatever the audit policy says.Process Trees and Call Chains shows how to read it.Run Sysmon with ProcessCreate events in its configuration.
DeviceProcessEvents (opens in a new tab)Each row is a process creation or a related event, naming the new process, the process that created it and that creator's parent.Defender XDR, advanced huntingProcessCommandLine and InitiatingProcessCommandLine, the command and the one that started it.The Defender for Endpoint sensor on the device
4104 Script Block Logging (opens in a new tab)Microsoft-Windows-PowerShell/OperationalIt is written on the computer that ran Windows PowerShell. PowerShell 7 writes the same event to PowerShellCore/Operational.The script block PowerShell actually ran, decoded, where script block logging is on.Command Line and Environment shows how to read it.Turn on PowerShell Script Block Logging through Group Policy or the Registry.
AsrObfuscatedScriptAudited, AsrObfuscatedScriptBlocked (opens in a new tab)The attack surface reduction (ASR) rule against potentially obfuscated scripts fired, in audit or block mode.DeviceEventsDefender XDR, advanced huntingThe ASR rule against potentially obfuscated scripts fired, in audit or block mode.The Defender for Endpoint sensor on the device

What It Looks Like

This record is decoded field by field, with what each value means.

1 Process creation (opens in a new tab)On ws-017, . An illustration of Sysmon event 1 on ws-017, dana's workstation, on 26 Oct 2026, with the encoded text cut short.
Field, as the Record Writes ItWhat It Tells You
ImageC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindows PowerShell, genuine and in its home folder. The program is fine, so read what it was told to do.
CommandLinepowershell.exe -w hidden -enc SQBFAFgA...A hidden window and a Base64 command, cut short here, so what runs cannot be read off the line. Where script block logging is on, event 4104 in the Microsoft-Windows-PowerShell/Operational log records it decoded.
ParentImageC:\Windows\explorer.exeStarted by the shell at sign-in, which is how a Run key or Startup folder entry runs. Check those for the entry that holds this command.
False Positives

Management and deployment tools pass encoded commands and hidden windows to PowerShell to avoid quoting problems, so know which of yours do.

Blind Spots

Without the policy Include command line in process creation events, event 4688 in the Security log holds no command line, and a live read shows only what the PEB holds now.

PowerShell 7 writes script blocks to its own PowerShellCore/Operational channel, which a search of the Windows PowerShell log misses.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents (documentation, opens in a new tab)

Needs Defender for Endpoint. Management tools send encoded commands too, so read the parent and account. Splunk's encoded command rule matches more forms of the switch, so compare with it before trusting a clean result.

KQLDefender XDR, Advanced hunting
// Encoded or hidden PowerShell, and service hosts or proxies started with no argumentsDeviceProcessEvents| where Timestamp > ago(30d)| where isnotempty(ProcessCommandLine)| extend Name = tolower(FileName)| where (Name in ("powershell.exe", "pwsh.exe")        and ProcessCommandLine matches regex @"(?i)(^|\s)(/|--?)(e|ec|en|enc|enco|encod|encode|encoded|encodedc|encodedco|encodedcom|encodedcomm|encodedcomma|encodedcomman|encodedcommand)\s")    or (Name in ("powershell.exe", "pwsh.exe") and ProcessCommandLine matches regex @"(?i)\s[-/]w[a-z]*\s+(hidden|1)(\s|$)")    or (Name matches regex @"^[svchot]{6,8}\.exe$" and not(ProcessCommandLine matches regex @"(?i)\s-k\s"))    or (Name in ("rundll32.exe", "dllhost.exe") and ProcessCommandLine matches regex @"(?i)(rundll32|dllhost)(\.exe)?\W*$")| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, AccountName, ProcessCommandLine| order by Timestamp desc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

Show the 6 Public Rules

How to Prevent It

Each control helps prevent it, and its line says what it does here.

Related

Where It Matters Most
  • svchost.exe No -k group on its command line. SigmaHQ calls a copy with no arguments at all extremely abnormal.
Travels with
  • Abused Built-In and Admin Tools An encoded or hidden command runs through a genuine program such as powershell.exe, so the binary passes and the command line is the finding.

Sources

MITRE ATT&CK is a free public catalogue of the techniques attackers use. Each technique has an ID, such as T1055 for Process Injection, so defenders can name the same behaviour the same way. This red flag can point to these techniques.