attack.t1036.007

Suspicious LNK Double Extension File Created

Oct 23, 2023 · attack.defense_evasion attack.t1036.007 ·

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

Suspicious Double Extension Files

Oct 18, 2023 · attack.defense_evasion attack.t1036.007 ·

Share on:

Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.

Suspicious Parent Double Extension File Execution

Oct 18, 2023 · attack.defense_evasion attack.t1036.007 ·

Share on:

Detect execution of suspicious double extension files in ParentCommandLine

Process Creation With Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.t1036 attack.t1036.007 ·

Share on:

Detects process creation utilizing double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.