huntrule

Windows Process Creation: Image contains NTFS 8.3 short filename patterns

Flags process creation events where the Image contains Windows 8.3 short-name patterns (e.g., ~1.exe, ~2.ps1) to evade image-based detections.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: Image contains NTFS 8.3 short filename patterns"
id: 131b593f-809d-42c1-86c4-792e29504de4
related:
  - id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795
    type: similar
  - id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b
    type: derived
status: test
description: This rule identifies Windows processes where the recorded Image path contains common NTFS 8.3 short-name patterns (e.g., ~1.exe, ~2.ps1). Attackers may use these short names to reduce the effectiveness of filename-based image detections and complicate asset visibility. It relies on process creation telemetry, specifically the Image field content and ParentImage exclusions for common benign parent processes and known installer paths.
references:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/jonasLyk/status/1555914501802921984
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-06
modified: 2023-07-20
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - ~1.bat
      - ~1.dll
      - ~1.exe
      - ~1.hta
      - ~1.js
      - ~1.msi
      - ~1.ps1
      - ~1.tmp
      - ~1.vbe
      - ~1.vbs
      - ~2.bat
      - ~2.dll
      - ~2.exe
      - ~2.hta
      - ~2.js
      - ~2.msi
      - ~2.ps1
      - ~2.tmp
      - ~2.vbe
      - ~2.vbs
  filter_main_generic_parent:
    ParentImage: C:\Windows\explorer.exe
  filter_optional_webex:
    ParentImage|endswith: \WebEx\WebexHost.exe
  filter_optional_thor:
    ParentImage|endswith: \thor\thor64.exe
  filter_optional_winzip:
    Image: C:\PROGRA~1\WinZip\WZPREL~1.EXE
  filter_optional_vcred:
    Image|endswith: \VCREDI~1.EXE
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Software Installers
level: medium
license: DRL-1.1

What it detects

This rule identifies Windows processes where the recorded Image path contains common NTFS 8.3 short-name patterns (e.g., ~1.exe, ~2.ps1). Attackers may use these short names to reduce the effectiveness of filename-based image detections and complicate asset visibility. It relies on process creation telemetry, specifically the Image field content and ParentImage exclusions for common benign parent processes and known installer paths.

Known false positives

  • Software Installers

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.