Detectionmediumtest

Use Short Name Path in Image

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

François Hubaut, Nasreddine Bencherchali (Nextron Systems)Created Sun Aug 07Updated Mon Oct 20a96970af-f126-420d-90e1-d37bf25e50e1windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|contains:
            - '~1\'
            - '~2\'
    filter_main_system_process:
        ParentImage:
            - 'C:\Windows\System32\Dism.exe'
            - 'C:\Windows\System32\cleanmgr.exe'  # Spawns DismHost.exe with a shortened username (if too long)
    filter_main_installers:
        - Image|contains|all:
              - '\AppData\'
              - '\Temp\'
        - Image|endswith:
              - '~1\unzip.exe'
              - '~1\7zG.exe'
    filter_optional_webex:
        ParentImage|endswith: '\WebEx\WebexHost.exe' # Spawns a shortened version of the CLI and Image processes
    filter_optional_thor:
        ParentImage|endswith: '\thor\thor64.exe'
    filter_optional_installshield:
        - Product: 'InstallShield (R)'
        - Description: 'InstallShield (R) Setup Engine'
        - Company: 'InstallShield Software Corporation'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False Positives

Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion

Sub-techniques

T1564.004 · NTFS File Attributes

Related Rules

SimilarThreat Huntmedium

Use Short Name Path in Command Line

Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations. Windows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs. When investigating, examine: - Commands using short paths to access sensitive directories or files - Web servers on Windows (especially Apache) where short filenames could bypass security controls - Correlation with other suspicious behaviors - baseline of short name usage in your environment and look for deviations

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

a96970af-f126-420d-90e1-d37bf25e50e1

Status

test

Level

medium

Type

Detection

Created

Sun Aug 07

Modified

Mon Oct 20

Author

François Hubaut, Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml

Raw Tags

attack.defense-evasionattack.t1564.004

View on GitHub