Detect built-in cmd commands

[explorer125]

How Can sysmon detect execution of built in cmd commands such as echo, mkdir, del etc.?

[darkoperator]

Sadly it can not. That would be possible if it where implemented as a transcript feature inside of cmd.exe similar to what PS has

[explorer125]

If I run these commands from PS, would Sysmon detect?

[darkoperator]

Unless they are as part of the start of the process as a command line parameter it can not. In the case of PS you would need to configure transcription via the registry or GPO. Collection would be having the transcripts sent to a share

[explorer125]

I have enabled script block logging and even if I execute echo from PS (Without it being part of command line parameter), Windows event captures it under event id 4104. Can't sysmon detect this?

[darkoperator]

Scriptblock login is not the same as transcript. https://4sysops.com/archives/powershell-transcript-record-a-session-to-a-text-file/