Windows Process Creation Ending in .exe With No Image Name

Flags Windows process creation events where the .exe path exists but the image name is missing, indicating possible stealth or evasion.

FreeUnreviewedSigmamediumv1

windows-process-creation-ending-in-exe-with-no-image-name-f208d6d8

title: Windows Process Creation Ending in .exe With No Image Name
id: 9abfc2b3-d0c0-411c-83ee-d9f1612e7289
status: test
description: This rule identifies Windows process creation events where the process image path ends with ".exe" but no image name is present. Attackers can exploit missing or incomplete image naming to reduce the effectiveness of image-based detections and hide execution details. The detection relies on process creation telemetry, specifically the presence of an executable path ending in ".exe" and the absence of an image name field. Rare legitimate software may also trigger this condition.
references:
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_no_image_name.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2024-07-23
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \.exe
  condition: selection
falsepositives:
  - Rare legitimate software.
level: medium
license: DRL-1.1
related:
  - id: f208d6d8-d83a-4c2c-960d-877c37da84e5
    type: derived

What it detects

This rule identifies Windows process creation events where the process image path ends with ".exe" but no image name is present. Attackers can exploit missing or incomplete image naming to reduce the effectiveness of image-based detections and hide execution details. The detection relies on process creation telemetry, specifically the presence of an executable path ending in ".exe" and the absence of an image name field. Rare legitimate software may also trigger this condition.

Known false positives

Rare legitimate software.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.