Windows Process Creation: Command Lines Using 8.3 Short Name Paths (~1\, ~2\)

Alert on Windows command lines referencing 8.3 short paths (~1\, ~2\) that may indicate path obfuscation.

FreeUnreviewedSigmamediumv1

windows-process-creation-command-lines-using-8-3-short-name-paths-1-2-349d891d

title: "Windows Process Creation: Command Lines Using 8.3 Short Name Paths (~1\\, ~2\\)"
id: 9741992a-7752-4e00-8369-5105e708aef1
related:
  - id: a96970af-f126-420d-90e1-d37bf25e50e1
    type: similar
  - id: 349d891d-fef0-4fe4-bc53-eee623a15969
    type: derived
status: test
description: This rule flags Windows process creation events where the command line contains short 8.3-style path fragments such as "~1\" or "~2\". Short-name paths can help obscure real directories and are sometimes used to interact with locations or content that may be less visible to defenders. Detection relies on process_creation telemetry with command-line fields, and it excludes common benign parent processes to reduce noise.
references:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/frack113/status/1555830623633375232
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-07
modified: 2025-10-22
tags:
  - attack.stealth
  - attack.t1564.004
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ~1\
      - ~2\
  filter_main_system_process:
    ParentImage:
      - C:\Windows\System32\Dism.exe
      - C:\Windows\System32\cleanmgr.exe
  filter_main_winget:
    - ParentImage|endswith: \winget.exe
    - ParentImage|contains: \AppData\Local\Temp\WinGet\
  filter_main_csc:
    ParentImage|startswith: C:\Windows\Microsoft.NET\Framework64\v
    ParentImage|endswith: \csc.exe
  filter_main_installers:
    - Image|contains|all:
        - \AppData\
        - \Temp\
    - CommandLine|contains: \AppData\Local\Temp\
  filter_optional_dopus:
    ParentImage: C:\Program Files\GPSoftware\Directory Opus\dopus.exe
  filter_optional_aurora:
    ParentImage|endswith:
      - \aurora-agent-64.exe
      - \aurora-agent.exe
  filter_optional_thor:
    ParentImage|endswith: \thor\thor64.exe
  filter_optional_git:
    CommandLine|contains:
      - C:\Program Files\Git\post-install.bat
      - C:\Program Files\Git\cmd\scalar.exe
  filter_optional_webex:
    - ParentImage|endswith: \WebEx\webexhost.exe
    - CommandLine|contains: \appdata\local\webex\webex64\meetings\wbxreport.exe
  filter_optional_veeam:
    ParentImage|endswith: \veeam.backup.shell.exe
  filter_optional_everything:
    ParentImage|endswith: \Everything\Everything.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Applications could use this notation occasionally which might generate some false positives. In that case investigate the parent and child process.
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the command line contains short 8.3-style path fragments such as "~1\" or "~2\". Short-name paths can help obscure real directories and are sometimes used to interact with locations or content that may be less visible to defenders. Detection relies on process_creation telemetry with command-line fields, and it excludes common benign parent processes to reduce noise.

Known false positives

Applications could use this notation occasionally which might generate some false positives. In that case investigate the parent and child process.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.