Windows Process Creation: Detect Use of 8.3 Short Name in Image Path (~1/~2)

Alerts on Windows process launches whose Image path contains 8.3 short-name markers (~1\ or ~2\), excluding several known benign parents.

FreeUnreviewedSigmamediumv1

windows-process-creation-detect-use-of-8-3-short-name-in-image-path-1-2-a96970af

title: "Windows Process Creation: Detect Use of 8.3 Short Name in Image Path (~1/~2)"
id: b1c10fb5-baef-4ca6-8b41-ff45d578fc7c
related:
  - id: 349d891d-fef0-4fe4-bc53-eee623a15969
    type: similar
  - id: a96970af-f126-420d-90e1-d37bf25e50e1
    type: derived
status: test
description: This rule flags process creation events where the process Image path contains Windows 8.3 short-name segments (~1\ or ~2\), a technique that can be used to evade pathname-based detections. It helps analysts identify potentially obfuscated execution paths by correlating the Image field with multiple common safe-process filters. Telemetry relies on Windows process creation logs that include the Image path and ParentImage.
references:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/frack113/status/1555830623633375232
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-07
modified: 2025-10-20
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - ~1\
      - ~2\
  filter_main_system_process:
    ParentImage:
      - C:\Windows\System32\Dism.exe
      - C:\Windows\System32\cleanmgr.exe
  filter_main_installers:
    - Image|contains|all:
        - \AppData\
        - \Temp\
    - Image|endswith:
        - ~1\unzip.exe
        - ~1\7zG.exe
  filter_optional_webex:
    ParentImage|endswith: \WebEx\WebexHost.exe
  filter_optional_thor:
    ParentImage|endswith: \thor\thor64.exe
  filter_optional_installshield:
    - Product: InstallShield (R)
    - Description: InstallShield (R) Setup Engine
    - Company: InstallShield Software Corporation
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.
level: medium
license: DRL-1.1

What it detects

This rule flags process creation events where the process Image path contains Windows 8.3 short-name segments (~1\ or ~2\), a technique that can be used to evade pathname-based detections. It helps analysts identify potentially obfuscated execution paths by correlating the Image field with multiple common safe-process filters. Telemetry relies on Windows process creation logs that include the Image path and ParentImage.

Known false positives

Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.