Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that windows hide default extensions by default.

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

Detect execution of suspicious double extension files in ParentCommandLine