Windows Process Creation: Command Line Uses 8.3 Short-Name Paths (~1 or ~2)
Alert on Windows command lines referencing 8.3 short paths (~1\, ~2\) that may indicate path obfuscation.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2022-08-07
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line contains 8.3 short-name path segments such as "~1\" or "~2\". Attackers may use short-name paths to obscure file locations, bypass naive path-based filters, or reach restricted resources. The detection relies on process creation telemetry with the full CommandLine field and uses parent/known application exclusions to reduce common benign sources.
Reporting behind it
- acunetix.comhttps://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
- twitter.comhttps://twitter.com/frack113/status/1555830623633375232
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-command-lines-using-8-3-short-name-paths-1-2-349d891d
title: "Windows Process Creation: Command Line Uses 8.3 Short-Name Paths (~1 or ~2)"
id: 9741992a-7752-4e00-8369-5105e708aef1
related:
- id: a96970af-f126-420d-90e1-d37bf25e50e1
type: similar
- id: 349d891d-fef0-4fe4-bc53-eee623a15969
type: derived
status: test
description: This rule flags Windows process creation events where the command line contains 8.3 short-name path segments such as "~1\" or "~2\". Attackers may use short-name paths to obscure file locations, bypass naive path-based filters, or reach restricted resources. The detection relies on process creation telemetry with the full CommandLine field and uses parent/known application exclusions to reduce common benign sources.
references:
- https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
- https://twitter.com/frack113/status/1555830623633375232
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-07
modified: 2025-10-22
tags:
- attack.stealth
- attack.t1564.004
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- ~1\
- ~2\
filter_main_system_process:
ParentImage:
- C:\Windows\System32\Dism.exe
- C:\Windows\System32\cleanmgr.exe
filter_main_winget:
- ParentImage|endswith: \winget.exe
- ParentImage|contains: \AppData\Local\Temp\WinGet\
filter_main_csc:
ParentImage|startswith: C:\Windows\Microsoft.NET\Framework64\v
ParentImage|endswith: \csc.exe
filter_main_installers:
- Image|contains|all:
- \AppData\
- \Temp\
- CommandLine|contains: \AppData\Local\Temp\
filter_optional_dopus:
ParentImage: C:\Program Files\GPSoftware\Directory Opus\dopus.exe
filter_optional_aurora:
ParentImage|endswith:
- \aurora-agent-64.exe
- \aurora-agent.exe
filter_optional_thor:
ParentImage|endswith: \thor\thor64.exe
filter_optional_git:
CommandLine|contains:
- C:\Program Files\Git\post-install.bat
- C:\Program Files\Git\cmd\scalar.exe
filter_optional_webex:
- ParentImage|endswith: \WebEx\webexhost.exe
- CommandLine|contains: \appdata\local\webex\webex64\meetings\wbxreport.exe
filter_optional_veeam:
ParentImage|endswith: \veeam.backup.shell.exe
filter_optional_everything:
ParentImage|endswith: \Everything\Everything.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Applications could use this notation occasionally which might generate some false positives. In that case investigate the parent and child process.
level: medium
license: DRL-1.1