Windows File Path

Try a value

Reads it as C:\Windows\System32\drivers\WdfLdr.sys

Worked samples

DuckDB 1.5.5 · finetype 0.6.66

Shape

Length at least 3 characters.

Background

Origin

Microsoft's Win32 documentation defines a path as one or more components separated by a backslash, each component usually being a directory name or file name.^[1] The .NET documentation describes a standard DOS path as a volume or drive letter followed by the volume separator (:), a directory name, and an optional filename.^[2] UNC paths are used to access network resources and begin with a server or host name prefaced by two backslashes, followed by a share name.^[2]

Use

Microsoft's monitoring advice for event 4688 suggests checking whether the process name is outside a standard folder such as System32 or Program Files.^[3] Sysmon's image filter condition matches an image path by full path or by image name alone, so that lsass.exe matches c:\windows\system32\lsass.exe.^[4]

Microsoft advises not to assume case sensitivity in Windows names, treating OSCAR, Oscar and oscar as the same name.^[1] Microsoft's naming rules state that drive letters are case-insensitive, so D:\ and d:\ refer to the same volume.^[1] Compare and deduplicate Windows paths case-insensitively, or two spellings of one file will count as two files. (Meridian's view) During Windows path normalisation, all forward slashes are converted into the standard Windows separator, the backslash.^[2]

A path such as C:Projects\file.sln, with a drive letter but no backslash after the colon, is relative to the current directory of that drive rather than to its root.^[2] The .NET documentation calls such drive-relative paths a common source of program and script logic errors.^[2] Microsoft's documentation explains that a \\?\ prefix tells the Windows APIs to disable string parsing and pass the path straight to the file system.^[1] In editions of Windows before Windows 10 version 1607, the maximum path length is MAX_PATH, defined as 260 characters.^[1] In pathlib, a UNC share such as //host/share is treated as the drive of a PureWindowsPath.^[5] Parsing with a library built for Windows paths is safer than splitting on backslashes by hand, since UNC roots, device prefixes and mixed separators all trip up a naive split. (Meridian's view)

Sources

1. [1]Naming Files, Paths, and Namespaces - Win32 appsdocumentation
2. [2]File path formats on Windows systems - .NETdocumentation
3. [3]4688(S) A new process has been created. - Windows 10documentation
4. [4]Sysmon - Sysinternalsdocumentation
5. [5]pathlib — Object-oriented filesystem pathsdocumentation

Detection notes

Use it

Schema

Aliases