Windows Command Line Obfuscation with NTFS Short Names
This rule detects the use of Windows 8.3 short names in command-line arguments. Adversaries may use this technique to obfuscate their commands and evade detection by security tools that rely on full file paths or specific keywords. The rule specifically looks for patterns like '~1.exe', '~1.bat', etc., which are indicative of short name usage. This can be a defense evasion technique.
Sigma
