huntrule

Windows: Uncommon format.com File System Load via /fs parameter

Alerts on format.com executions with atypical /fs: parameters, which may indicate defense-evasion use of Windows utilities.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-01-04
Updated
2026-07-31
AnalysisDetection
title: "Windows: Uncommon format.com File System Load via /fs parameter"
id: 637ed395-da2f-4600-ae9c-cc0c99ec2a09
status: test
description: "This rule identifies process creation where format.com is launched with a /fs: argument using a filesystem value other than common defaults. Adversaries may use format.com to load external or auxiliary components in a less typical way to reduce detection and complicate analysis. It relies on Windows process creation telemetry, specifically the image path ending with \\format.com and the command line containing /fs: with uncommon filesystem selections."
references:
  - https://twitter.com/0gtweet/status/1477925112561209344
  - https://twitter.com/wdormann/status/1478011052130459653?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_format_uncommon_filesystem_load.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2024-05-13
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \format.com
    CommandLine|contains: "/fs:"
  filter_main_known_fs:
    CommandLine|contains:
      - /fs:exFAT
      - /fs:FAT
      - /fs:NTFS
      - /fs:ReFS
      - /fs:UDF
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9fb6b26e-7f9e-4517-a48b-8cac4a1b6c60
    type: derived