Windows Process Command Line Contains NTFS 8.3 Short Filename Patterns (~1/~2.*)
Detects Windows command lines referencing NTFS 8.3 short names like ~1.exe or ~2.ps1.
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-05
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions whose command line contains NTFS 8.3 short filename patterns such as ~1.exe, ~2.bat, and ~1.ps1. Attackers may use short names to reduce the chance that defenders match fully qualified filenames in command-line telemetry. It relies on process creation events and inspects the CommandLine field for the defined short-name tokens while excluding a small set of known benign parent/child command-line combinations.
Reporting behind it
- acunetix.comhttps://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
- twitter.comhttps://twitter.com/jonasLyk/status/1555914501802921984
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Command Line Contains NTFS 8.3 Short Filename Patterns (~1/~2.*)
id: 02dae700-d4f6-4e56-87e2-475df6860c27
related:
- id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b
type: similar
- id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795
type: derived
status: test
description: This rule flags Windows process executions whose command line contains NTFS 8.3 short filename patterns such as ~1.exe, ~2.bat, and ~1.ps1. Attackers may use short names to reduce the chance that defenders match fully qualified filenames in command-line telemetry. It relies on process creation events and inspects the CommandLine field for the defined short-name tokens while excluding a small set of known benign parent/child command-line combinations.
references:
- https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
- https://twitter.com/jonasLyk/status/1555914501802921984
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
modified: 2022-09-21
tags:
- attack.stealth
- attack.t1564.004
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- ~1.exe
- ~1.bat
- ~1.msi
- ~1.vbe
- ~1.vbs
- ~1.dll
- ~1.ps1
- ~1.js
- ~1.hta
- ~2.exe
- ~2.bat
- ~2.msi
- ~2.vbe
- ~2.vbs
- ~2.dll
- ~2.ps1
- ~2.js
- ~2.hta
filter:
- ParentImage|endswith:
- \WebEx\WebexHost.exe
- \thor\thor64.exe
- CommandLine|contains: C:\xampp\vcredist\VCREDI~1.EXE
condition: selection and not filter
falsepositives:
- Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.
level: medium
license: DRL-1.1