Use Short Name Path in Command Line

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•27

Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations. Windows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs. This technique can be used to bypass security controls, especially in web servers on Windows.