Windows Process Creation Ending in .exe With No Image Name
Flags Windows process creation events where the .exe path exists but the image name is missing, indicating possible stealth or evasion.
- Product
- windows
- Category
- process_creation
- Author
- Matt Anderson (Huntress) (SigmaHQ), DRL 1.1
- Published
- 2024-07-23
- Updated
- 2026-07-30
What it detects
This rule identifies Windows process creation events where the process image path ends with ".exe" but no image name is present. Attackers can exploit missing or incomplete image naming to reduce the effectiveness of image-based detections and hide execution details. The detection relies on process creation telemetry, specifically the presence of an executable path ending in ".exe" and the absence of an image name field. Rare legitimate software may also trigger this condition.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Creation Ending in .exe With No Image Name
id: 9abfc2b3-d0c0-411c-83ee-d9f1612e7289
status: test
description: This rule identifies Windows process creation events where the process image path ends with ".exe" but no image name is present. Attackers can exploit missing or incomplete image naming to reduce the effectiveness of image-based detections and hide execution details. The detection relies on process creation telemetry, specifically the presence of an executable path ending in ".exe" and the absence of an image name field. Rare legitimate software may also trigger this condition.
references:
- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_no_image_name.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2024-07-23
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \.exe
condition: selection
falsepositives:
- Rare legitimate software.
level: medium
license: DRL-1.1
related:
- id: f208d6d8-d83a-4c2c-960d-877c37da84e5
type: derived