# Obfuscation in CLI arguments

**URL:** <https://community.limacharlie.com/t/obfuscation-in-cli-arguments/20>\
**Category:** Detection & Response Rules\
**Tags:** detection, windows\
**Created:** [February 14, 2025, 5:42am UTC](https://community.limacharlie.com/t/obfuscation-in-cli-arguments/20 "2025-02-14T05:42:14Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![eric\_capuano](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/eric_capuano/32/4_2.png) [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\
**Post date:** [February 14, 2025, 5:42am UTC](https://community.limacharlie.com/t/obfuscation-in-cli-arguments/20/1 "2025-02-14T05:42:14Z")

</div>

**Rule Description**  
Looks for possible obfuscations in command line args (`n^e^t u^s^er`)

**Detect**

```yaml
event: NEW_PROCESS
op: matches
path: event/COMMAND_LINE
re: (?:[a-zA-Z]\^)+[a-zA-Z]

```

**Respond**

```yaml
- action: report
  name: Possible obfuscation in CLI args

```