Windows Process Command Line Contains NTFS 8.3 Short Filename Patterns (~1/~2.*)

Detects Windows command lines referencing NTFS 8.3 short names like ~1.exe or ~2.ps1.

FreeUnreviewedSigmamediumv1

windows-process-command-line-contains-ntfs-8-3-short-filename-patterns-1-2-dd6b39d9

title: Windows Process Command Line Contains NTFS 8.3 Short Filename Patterns (~1/~2.*)
id: 02dae700-d4f6-4e56-87e2-475df6860c27
related:
  - id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b
    type: similar
  - id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795
    type: derived
status: test
description: This rule flags Windows process executions whose command line contains NTFS 8.3 short filename patterns such as ~1.exe, ~2.bat, and ~1.ps1. Attackers may use short names to reduce the chance that defenders match fully qualified filenames in command-line telemetry. It relies on process creation events and inspects the CommandLine field for the defined short-name tokens while excluding a small set of known benign parent/child command-line combinations.
references:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/jonasLyk/status/1555914501802921984
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
modified: 2022-09-21
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ~1.exe
      - ~1.bat
      - ~1.msi
      - ~1.vbe
      - ~1.vbs
      - ~1.dll
      - ~1.ps1
      - ~1.js
      - ~1.hta
      - ~2.exe
      - ~2.bat
      - ~2.msi
      - ~2.vbe
      - ~2.vbs
      - ~2.dll
      - ~2.ps1
      - ~2.js
      - ~2.hta
  filter:
    - ParentImage|endswith:
        - \WebEx\WebexHost.exe
        - \thor\thor64.exe
    - CommandLine|contains: C:\xampp\vcredist\VCREDI~1.EXE
  condition: selection and not filter
falsepositives:
  - Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process executions whose command line contains NTFS 8.3 short filename patterns such as ~1.exe, ~2.bat, and ~1.ps1. Attackers may use short names to reduce the chance that defenders match fully qualified filenames in command-line telemetry. It relies on process creation events and inspects the CommandLine field for the defined short-name tokens while excluding a small set of known benign parent/child command-line combinations.

Known false positives

Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.