Windows: Uncommon format.com File System Load via /fs parameter
Alerts on format.com executions with atypical /fs: parameters, which may indicate defense-evasion use of Windows utilities.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-04
- Updated
- 2026-07-31
What it detects
This rule identifies process creation where format.com is launched with a /fs: argument using a filesystem value other than common defaults. Adversaries may use format.com to load external or auxiliary components in a less typical way to reduce detection and complicate analysis. It relies on Windows process creation telemetry, specifically the image path ending with \format.com and the command line containing /fs: with uncommon filesystem selections.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-format-com-invoked-with-uncommon-fs-filesystem-parameter-9fb6b26e
title: "Windows: Uncommon format.com File System Load via /fs parameter"
id: 637ed395-da2f-4600-ae9c-cc0c99ec2a09
status: test
description: "This rule identifies process creation where format.com is launched with a /fs: argument using a filesystem value other than common defaults. Adversaries may use format.com to load external or auxiliary components in a less typical way to reduce detection and complicate analysis. It relies on Windows process creation telemetry, specifically the image path ending with \\format.com and the command line containing /fs: with uncommon filesystem selections."
references:
- https://twitter.com/0gtweet/status/1477925112561209344
- https://twitter.com/wdormann/status/1478011052130459653?s=20
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_format_uncommon_filesystem_load.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2024-05-13
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \format.com
CommandLine|contains: "/fs:"
filter_main_known_fs:
CommandLine|contains:
- /fs:exFAT
- /fs:FAT
- /fs:NTFS
- /fs:ReFS
- /fs:UDF
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60
type: derived