Windows Process Creation: Command Line Uses 8.3 Short-Name Paths (~1 or ~2)

Alert on Windows command lines referencing 8.3 short paths (~1\, ~2\) that may indicate path obfuscation.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_creation
Author: frack113, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published: 2022-08-07
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564.004NTFS File Attributes
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the command line contains 8.3 short-name path segments such as "~1\" or "~2\". Attackers may use short-name paths to obscure file locations, bypass naive path-based filters, or reach restricted resources. The detection relies on process creation telemetry with the full CommandLine field and uses parent/known application exclusions to reduce common benign sources.

Reporting behind it

Related detections9 linkedT1564.004 — drag to rearrange

Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)

Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)

Suspicious Run Key Referencing Alternate Data Stream Payload

macOS chflags Hidden Flag Set via chflags hidden parameter

Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream

Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Windows suspicious file download URLs using direct IP address with script/binary extensions

Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs

Windows Process Creation: Command Line Uses 8.3 Short-Name Paths (~1 or ~2)

Pivot detection · T1564.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-command-lines-using-8-3-short-name-paths-1-2-349d891d

title: "Windows Process Creation: Command Line Uses 8.3 Short-Name Paths (~1 or ~2)"
id: 9741992a-7752-4e00-8369-5105e708aef1
related:
  - id: a96970af-f126-420d-90e1-d37bf25e50e1
    type: similar
  - id: 349d891d-fef0-4fe4-bc53-eee623a15969
    type: derived
status: test
description: This rule flags Windows process creation events where the command line contains 8.3 short-name path segments such as "~1\" or "~2\". Attackers may use short-name paths to obscure file locations, bypass naive path-based filters, or reach restricted resources. The detection relies on process creation telemetry with the full CommandLine field and uses parent/known application exclusions to reduce common benign sources.
references:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/frack113/status/1555830623633375232
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-07
modified: 2025-10-22
tags:
  - attack.stealth
  - attack.t1564.004
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ~1\
      - ~2\
  filter_main_system_process:
    ParentImage:
      - C:\Windows\System32\Dism.exe
      - C:\Windows\System32\cleanmgr.exe
  filter_main_winget:
    - ParentImage|endswith: \winget.exe
    - ParentImage|contains: \AppData\Local\Temp\WinGet\
  filter_main_csc:
    ParentImage|startswith: C:\Windows\Microsoft.NET\Framework64\v
    ParentImage|endswith: \csc.exe
  filter_main_installers:
    - Image|contains|all:
        - \AppData\
        - \Temp\
    - CommandLine|contains: \AppData\Local\Temp\
  filter_optional_dopus:
    ParentImage: C:\Program Files\GPSoftware\Directory Opus\dopus.exe
  filter_optional_aurora:
    ParentImage|endswith:
      - \aurora-agent-64.exe
      - \aurora-agent.exe
  filter_optional_thor:
    ParentImage|endswith: \thor\thor64.exe
  filter_optional_git:
    CommandLine|contains:
      - C:\Program Files\Git\post-install.bat
      - C:\Program Files\Git\cmd\scalar.exe
  filter_optional_webex:
    - ParentImage|endswith: \WebEx\webexhost.exe
    - CommandLine|contains: \appdata\local\webex\webex64\meetings\wbxreport.exe
  filter_optional_veeam:
    ParentImage|endswith: \veeam.backup.shell.exe
  filter_optional_everything:
    ParentImage|endswith: \Everything\Everything.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Applications could use this notation occasionally which might generate some false positives. In that case investigate the parent and child process.
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL