Process Creation with NTFS 8.3 Short Name
Detects the use of Windows 8.3 short names in process images, which can be leveraged by adversaries as a defense evasion technique to bypass image-based detections. This rule specifically looks for common executable and script file extensions preceded by '~1' or '~2' in the Image path.
Sigma
