Suspicious Double Extension Files

calendar Oct 16, 2026 · attack.stealth attack.t1036.007  ·
Share on: linkedin copy

Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.

Sigma rule (View on GitHub)

 1title: Suspicious Double Extension Files
 2id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e
 3related:
 4    - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
 5      type: derived
 6    - id: 3215aa19-f060-4332-86d5-5602511f3ca8
 7      type: similar
 8status: test
 9description: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.
10references:
11    - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
12    - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
13    - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
14    - https://twitter.com/malwrhunterteam/status/1235135745611960321
15    - https://twitter.com/luc4m/status/1073181154126254080
16    - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
17    - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
18author: Nasreddine Bencherchali (Nextron Systems), frack113
19date: 2022-06-19
20modified: 2026-10-16
21tags:
22    - attack.stealth
23    - attack.t1036.007
24logsource:
25    category: file_event
26    product: windows
27detection:
28    selection_gen:
29        TargetFilename|re|i: '\.(docx?|gif|jpe?g|mp3|mp4|pdf|png|pptx?|rtf|svg|txt|xlsx?)\.(bat|exe|iso|rar|svg|vbe|vbs|zip)$'
30    selection_exe:
31        TargetFilename|endswith:
32            - '.rar.exe'
33            - '.zip.exe'
34    # Note: If you wanna keep using the ".lnk" extension. You might uncomment this filter and add additional locations
35    # filter_main_lnk:
36    #     TargetFilename|contains:
37    #         - '\AppData\Roaming\Microsoft\Office\Recent\'
38    #         - '\AppData\Roaming\Microsoft\Windows\Recent\'
39    filter_main_legitimate_extensions:
40        TargetFilename|endswith:
41            - '.svg.svg'
42            - '.png.svg'
43            - '.jpg.svg'
44            - '.jpeg.svg'
45    filter_optional_icons_linux:
46        TargetFilename|startswith: '/usr/share/icons/'
47    condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
48falsepositives:
49    - Unlikely
50level: high
51regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_double_extension/info.yml

References

Related rules

to-top