huntrule

Windows Process Command Line Contains NTFS 8.3 Short Filename Patterns (~1/~2.*)

Detects Windows command lines referencing NTFS 8.3 short names like ~1.exe or ~2.ps1.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-08-05
Updated
2026-07-30
AnalysisDetection
title: Windows Process Command Line Contains NTFS 8.3 Short Filename Patterns (~1/~2.*)
id: 02dae700-d4f6-4e56-87e2-475df6860c27
related:
  - id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b
    type: similar
  - id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795
    type: derived
status: test
description: This rule flags Windows process executions whose command line contains NTFS 8.3 short filename patterns such as ~1.exe, ~2.bat, and ~1.ps1. Attackers may use short names to reduce the chance that defenders match fully qualified filenames in command-line telemetry. It relies on process creation events and inspects the CommandLine field for the defined short-name tokens while excluding a small set of known benign parent/child command-line combinations.
references:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/jonasLyk/status/1555914501802921984
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-05
modified: 2022-09-21
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ~1.exe
      - ~1.bat
      - ~1.msi
      - ~1.vbe
      - ~1.vbs
      - ~1.dll
      - ~1.ps1
      - ~1.js
      - ~1.hta
      - ~2.exe
      - ~2.bat
      - ~2.msi
      - ~2.vbe
      - ~2.vbs
      - ~2.dll
      - ~2.ps1
      - ~2.js
      - ~2.hta
  filter:
    - ParentImage|endswith:
        - \WebEx\WebexHost.exe
        - \thor\thor64.exe
    - CommandLine|contains: C:\xampp\vcredist\VCREDI~1.EXE
  condition: selection and not filter
falsepositives:
  - Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.
level: medium
license: DRL-1.1