{"id":"a96970af-f126-420d-90e1-d37bf25e50e1","title":"Use Short Name Path in Image","description":"Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-08-07","modified":"2025-10-20","tags":["attack.stealth","attack.t1564.004"],"technique_ids":["T1564.004"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process."],"references":["https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)","https://twitter.com/frack113/status/1555830623633375232"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml","source_sha256":"d4aeae081230a675f4ab40e8b947566b507a7abe1d4375010d81e2bc1a7a4acc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Use Short Name Path in Image\nid: a96970af-f126-420d-90e1-d37bf25e50e1\nrelated:\n    - id: 349d891d-fef0-4fe4-bc53-eee623a15969\n      type: similar\nstatus: test\ndescription: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection\nreferences:\n    - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)\n    - https://twitter.com/frack113/status/1555830623633375232\nauthor: frack113, Nasreddine Bencherchali\ndate: 2022-08-07\nmodified: 2025-10-20\ntags:\n    - attack.stealth\n    - attack.t1564.004\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|contains:\n            - '~1\\'\n            - '~2\\'\n    filter_main_system_process:\n        ParentImage:\n            - 'C:\\Windows\\System32\\Dism.exe'\n            - 'C:\\Windows\\System32\\cleanmgr.exe'  # Spawns DismHost.exe with a shortened username (if too long)\n    filter_main_installers:\n        - Image|contains|all:\n              - '\\AppData\\'\n              - '\\Temp\\'\n        - Image|endswith:\n              - '~1\\unzip.exe'\n              - '~1\\7zG.exe'\n    filter_optional_webex:\n        ParentImage|endswith: '\\WebEx\\WebexHost.exe' # Spawns a shortened version of the CLI and Image processes\n    filter_optional_thor:\n        ParentImage|endswith: '\\thor\\thor64.exe'\n    filter_optional_installshield:\n        - Product: 'InstallShield (R)'\n        - Description: 'InstallShield (R) Setup Engine'\n        - Company: 'InstallShield Software Corporation'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564.004","id":"T1564.004","name":"NTFS File Attributes","page":"techniques/enterprise/T1564.004/"}],"data_path":"data/detection-rules/a96970af-f126-420d-90e1-d37bf25e50e1.json","kind":"sigma"}