Windows format.com Invoked with Uncommon /fs Filesystem Parameter

title: Windows format.com Invoked with Uncommon /fs Filesystem Parameter
id: 637ed395-da2f-4600-ae9c-cc0c99ec2a09
status: test
description: "This rule flags process creation where format.com is executed with a filesystem selection parameter (/fs:) that is not one of several common values (e.g., NTFS, FAT, exFAT, ReFS, UDF). Attackers may abuse legitimate system utilities like format.com to stage or load malicious components in a way that blends into normal Windows activity. The detection relies on Windows process creation telemetry, specifically the executable path ending with \\format.com and the command line containing /fs: with an uncommon value."
references:
  - https://twitter.com/0gtweet/status/1477925112561209344
  - https://twitter.com/wdormann/status/1478011052130459653?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_format_uncommon_filesystem_load.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2024-05-13
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \format.com
    CommandLine|contains: "/fs:"
  filter_main_known_fs:
    CommandLine|contains:
      - /fs:exFAT
      - /fs:FAT
      - /fs:NTFS
      - /fs:ReFS
      - /fs:UDF
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60
    type: derived