Use Short Name Path in Image

Title: Use Short Name Path in Image
Status: test
Description:Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection
References:
  -https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  -https://twitter.com/frack113/status/1555830623633375232
Author: frack113, Nasreddine Bencherchali
Date: 2022-08-07
modified:2025-10-20
Tags:

• -'attack.stealth'
• -'attack.t1564.004'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|contains:
      -'~1\'
      -'~2\'

  filter_main_system_process:
    ParentImage:
      -'C:\Windows\System32\Dism.exe'
      -'C:\Windows\System32\cleanmgr.exe'

  filter_main_installers:
    - Image|contains|all:
      - '\AppData\'
      - '\Temp\'
    - Image|endswith:
      - '~1\unzip.exe'
      - '~1\7zG.exe'
  filter_optional_webex:
    ParentImage|endswith: '\WebEx\WebexHost.exe'
  filter_optional_thor:
    ParentImage|endswith: '\thor\thor64.exe'
  filter_optional_installshield:
Product:'InstallShield (R)' Description:'InstallShield (R) Setup Engine' Company:'InstallShield Software Corporation'   condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process.
Level: medium