Malware Command Line Keywords

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects the execution of processes where the command line contains keywords commonly associated with malware, specifically 'backdoor', 'rootkit', or 'trojan'. It monitors Windows Security Event ID 4688 (a process creation event) and flags any command lines containing these terms.