Windows Process Creation: Detect Use of 8.3 Short Name in Image Path (~1/~2)
Alerts on Windows process launches whose Image path contains 8.3 short-name markers (~1\ or ~2\), excluding several known benign parents.
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2022-08-07
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the process Image path contains Windows 8.3 short-name segments (~1\ or ~2\), a technique that can be used to evade pathname-based detections. It helps analysts identify potentially obfuscated execution paths by correlating the Image field with multiple common safe-process filters. Telemetry relies on Windows process creation logs that include the Image path and ParentImage.
Reporting behind it
- acunetix.comhttps://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
- twitter.comhttps://twitter.com/frack113/status/1555830623633375232
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Detect Use of 8.3 Short Name in Image Path (~1/~2)"
id: b1c10fb5-baef-4ca6-8b41-ff45d578fc7c
related:
- id: 349d891d-fef0-4fe4-bc53-eee623a15969
type: similar
- id: a96970af-f126-420d-90e1-d37bf25e50e1
type: derived
status: test
description: This rule flags process creation events where the process Image path contains Windows 8.3 short-name segments (~1\ or ~2\), a technique that can be used to evade pathname-based detections. It helps analysts identify potentially obfuscated execution paths by correlating the Image field with multiple common safe-process filters. Telemetry relies on Windows process creation logs that include the Image path and ParentImage.
references:
- https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
- https://twitter.com/frack113/status/1555830623633375232
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2022-08-07
modified: 2025-10-20
tags:
- attack.stealth
- attack.t1564.004
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains:
- ~1\
- ~2\
filter_main_system_process:
ParentImage:
- C:\Windows\System32\Dism.exe
- C:\Windows\System32\cleanmgr.exe
filter_main_installers:
- Image|contains|all:
- \AppData\
- \Temp\
- Image|endswith:
- ~1\unzip.exe
- ~1\7zG.exe
filter_optional_webex:
ParentImage|endswith: \WebEx\WebexHost.exe
filter_optional_thor:
ParentImage|endswith: \thor\thor64.exe
filter_optional_installshield:
- Product: InstallShield (R)
- Description: InstallShield (R) Setup Engine
- Company: InstallShield Software Corporation
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.
level: medium
license: DRL-1.1