huntrule

Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'

Alerts when Explorer spawns a process with command lines containing long Unicode whitespace padding followed by '#'.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-11-04
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the parent process is Explorer and the command line contains a '#' character while also including unusually long sequences of whitespace characters (including Unicode space variants). Attackers can use whitespace padding to visually obscure the meaningful portion of a command, helping conceal malicious instructions during user interaction. The detection relies on process creation telemetry with parent image context and command-line strings that preserve Unicode whitespace and punctuation.

Reporting behind it

Related detections9 linkedT1204 — drag to rearrange
Windows Registry RunMRU Path with Suspicious Space Characters and Delimiter
Windows Registry: Suspicious Space-Padded TypedPaths Details String
Suspicious Base64 Decoded Shell Dropper via Command Line
PowerShell ExportedCommands Array Index for Indirect Cmdlet Execution (Windows Process Creation)
Suspicious Web Browser Spawning Scripting or Command Interpreter (via process_creation)
Malicious PowerShell Spawned by File Explorer via FileFix Social Engineering (via process_creation)
Suspicious Encoded PowerShell DownloadString Execution
Suspicious Delayed Expansion Command Obfuscation Building PowerShell via Amatera Stealer
Malicious Edge Abuse for Payload Download via Console (via process_creation)
Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'
Pivot detection · T1204 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.