Windows Process Command Lines Referencing Dot-Suffixed File Paths

title: Windows Process Command Lines Referencing Dot-Suffixed File Paths
id: ef0e248b-c452-4051-bd0e-0b6f569985c7
status: test
description: This rule flags Windows process creation events where the command line contains a path segment matching a domain-like pattern with a trailing dot (e.g., \[alnum]{1,32}.[alnum]{1,6}.). Such naming can indicate malware staging or execution behaviors used to evade normal file handling and detection logic. Telemetry required is process creation with full command-line strings so the pattern can be matched reliably.
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
references:
  - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_single_dot_ending_file.yml
date: 2022-10-28
modified: 2023-02-05
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re: \\[a-zA-Z0-9]{1,32}\.[a-zA-Z0-9]{1,6}\.[ "']{1}
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a35c97c8-d9c4-4c89-a3e7-533dc0bcb73a
    type: derived