Windows Process Command Lines Referencing Dot-Suffixed File Names
Alerts on Windows process executions whose command lines reference file-path strings ending with a dot.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-28
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events where the command line contains a pattern resembling a dotted file reference in the form \<alphanumeric\>{1,32}.\<alphanumeric\>{1,6}. followed by a quoted character. Attackers may use dotted-path or filename schemes to trigger or stage payload activity, and this behavior can be seen in observed malware command lines. The detection relies on process_creation telemetry with access to the full CommandLine string.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_single_dot_ending_file.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-command-lines-referencing-dot-suffixed-file-paths-a35c97c8
title: Windows Process Command Lines Referencing Dot-Suffixed File Names
id: ef0e248b-c452-4051-bd0e-0b6f569985c7
status: test
description: This rule flags Windows process creation events where the command line contains a pattern resembling a dotted file reference in the form \<alphanumeric\>{1,32}.\<alphanumeric\>{1,6}. followed by a quoted character. Attackers may use dotted-path or filename schemes to trigger or stage payload activity, and this behavior can be seen in observed malware command lines. The detection relies on process_creation telemetry with access to the full CommandLine string.
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
references:
- https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_single_dot_ending_file.yml
date: 2022-10-28
modified: 2023-02-05
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|re: \\[a-zA-Z0-9]{1,32}\.[a-zA-Z0-9]{1,6}\.[ "']{1}
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a35c97c8-d9c4-4c89-a3e7-533dc0bcb73a
type: derived