Windows Process Creation: Command Line Uses 8.3 Short-Name Paths (~1 or ~2)

title: "Windows Process Creation: Command Line Uses 8.3 Short-Name Paths (~1 or ~2)"
id: 9741992a-7752-4e00-8369-5105e708aef1
related:
  - id: a96970af-f126-420d-90e1-d37bf25e50e1
    type: similar
  - id: 349d891d-fef0-4fe4-bc53-eee623a15969
    type: derived
status: test
description: This rule flags Windows process creation events where the command line contains 8.3 short-name path segments such as "~1\" or "~2\". Attackers may use short-name paths to obscure file locations, bypass naive path-based filters, or reach restricted resources. The detection relies on process creation telemetry with the full CommandLine field and uses parent/known application exclusions to reduce common benign sources.
references:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/frack113/status/1555830623633375232
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-07
modified: 2025-10-22
tags:
  - attack.stealth
  - attack.t1564.004
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - ~1\
      - ~2\
  filter_main_system_process:
    ParentImage:
      - C:\Windows\System32\Dism.exe
      - C:\Windows\System32\cleanmgr.exe
  filter_main_winget:
    - ParentImage|endswith: \winget.exe
    - ParentImage|contains: \AppData\Local\Temp\WinGet\
  filter_main_csc:
    ParentImage|startswith: C:\Windows\Microsoft.NET\Framework64\v
    ParentImage|endswith: \csc.exe
  filter_main_installers:
    - Image|contains|all:
        - \AppData\
        - \Temp\
    - CommandLine|contains: \AppData\Local\Temp\
  filter_optional_dopus:
    ParentImage: C:\Program Files\GPSoftware\Directory Opus\dopus.exe
  filter_optional_aurora:
    ParentImage|endswith:
      - \aurora-agent-64.exe
      - \aurora-agent.exe
  filter_optional_thor:
    ParentImage|endswith: \thor\thor64.exe
  filter_optional_git:
    CommandLine|contains:
      - C:\Program Files\Git\post-install.bat
      - C:\Program Files\Git\cmd\scalar.exe
  filter_optional_webex:
    - ParentImage|endswith: \WebEx\webexhost.exe
    - CommandLine|contains: \appdata\local\webex\webex64\meetings\wbxreport.exe
  filter_optional_veeam:
    ParentImage|endswith: \veeam.backup.shell.exe
  filter_optional_everything:
    ParentImage|endswith: \Everything\Everything.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Applications could use this notation occasionally which might generate some false positives. In that case investigate the parent and child process.
level: medium
license: DRL-1.1