← All detection heuristics · Shellcode
high
SC_STR_CMD
What it means
String 'cmd.exe' followed by an execution switch (/c, /k, or /r) — i.e. an actual invocation, not just a bare reference.
Why it fires
The rule matches 'cmd.exe' immediately followed by /c, /k, or /r, which is the shape of a real command invocation by shellcode or a macro launching a payload. Plain documentation mentions of 'cmd.exe' (e.g. in user manuals or embedded paths) do not fire the detector.
Other Shellcode heuristics
SC_STR_CREATEREMOTETHREAD SC_MSF_BIND SC_MSF_REVERSE SC_MSF_C2 SC_STR_URLDOWNLOAD SC_STR_WRITEPROCESSMEMORY SC_XOR_ENCODED SC_STR_CREATEPROCESS SC_EGG_HUNTER SC_STR_GETPROCADDRESS SC_HEAP_SPRAY SC_STR_LOADLIBRARY SC_API_HASH_RESOLVER SC_PEB_ACCESS_X64 SC_PEB_ACCESS SC_STR_POWERSHELL SC_STR_SHELLEXEC SC_STR_WINEXEC SC_STR_WSCRIPT SC_XOR_DECODER SC_XOR_DECODED_NETWORK_CONFIG SC_STR_BITSADMIN SC_STR_CERTUTIL SC_STR_MSHTA