huntrule

Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'

Alerts when Explorer spawns a process with command lines containing long Unicode whitespace padding followed by '#'.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'"
id: d820704e-7f93-4b1c-b21f-7efd7662ad8a
related:
  - id: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e
    type: similar
  - id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e
    type: similar
  - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8
    type: derived
status: experimental
description: This rule flags Windows process creation events where the parent process is Explorer and the command line contains a '#' character while also including unusually long sequences of whitespace characters (including Unicode space variants). Attackers can use whitespace padding to visually obscure the meaningful portion of a command, helping conceal malicious instructions during user interaction. The detection relies on process creation telemetry with parent image context and command-line strings that preserve Unicode whitespace and punctuation.
references:
  - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
  - https://mrd0x.com/filefix-clickfix-alternative/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_whitespace_padding.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-04
modified: 2025-11-26
tags:
  - attack.execution
  - attack.stealth
  - attack.t1204.004
  - attack.t1027.010
logsource:
  category: process_creation
  product: windows
detection:
  selection_explorer:
    ParentImage|endswith: \explorer.exe
    CommandLine|contains: "#"
  selection_space_variation:
    CommandLine|contains:
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      -             
      - "            "
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the parent process is Explorer and the command line contains a '#' character while also including unusually long sequences of whitespace characters (including Unicode space variants). Attackers can use whitespace padding to visually obscure the meaningful portion of a command, helping conceal malicious instructions during user interaction. The detection relies on process creation telemetry with parent image context and command-line strings that preserve Unicode whitespace and punctuation.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.