Use Short Name Path in Process Image

SigmaHQ Detections@sigmaHQ

•updated Oct 20, 2025•0•14

Detects the use of Windows 8.3 short filenames (e.g., `PROGRA~1`) in process image paths. This technique can be used by adversaries to evade detection mechanisms that rely on full file paths, as the short name might bypass certain allow-listing or block-listing rules.