{"id":"b4926b47-a9d7-434c-b3a0-adc3fa0bd13e","title":"Suspicious Double Extension Files","description":"Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"high","date":"2022-06-19","modified":"2026-03-31","tags":["attack.stealth","attack.t1036.007"],"technique_ids":["T1036.007"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Unlikely"],"references":["https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/","https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations","https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles","https://twitter.com/malwrhunterteam/status/1235135745611960321","https://twitter.com/luc4m/status/1073181154126254080","https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites","https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/"],"source_path":"rules/windows/file/file_event/file_event_win_susp_double_extension.yml","source_sha256":"55d66ff736f27d5271790d4ff6d4c750471296214e83d1f261789d273d200810","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_double_extension.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Double Extension Files\nid: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e\nrelated:\n    - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8\n      type: derived\n    - id: 3215aa19-f060-4332-86d5-5602511f3ca8\n      type: similar\nstatus: test\ndescription: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.\nreferences:\n    - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/\n    - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations\n    - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles\n    - https://twitter.com/malwrhunterteam/status/1235135745611960321\n    - https://twitter.com/luc4m/status/1073181154126254080\n    - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites\n    - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/\nauthor: Nasreddine Bencherchali (Nextron Systems), frack113\ndate: 2022-06-19\nmodified: 2026-03-31\ntags:\n    - attack.stealth\n    - attack.t1036.007\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection_gen:\n        TargetFilename|endswith:\n            - '.exe'\n            - '.iso'\n            - '.rar'\n            - '.svg'\n            - '.zip'\n            # - '.lnk'  # legitimate links can happen just anywhere\n        TargetFilename|contains:\n            - '.doc.'\n            - '.docx.'\n            - '.gif.'\n            - '.jpeg.'\n            - '.jpg.'\n            - '.mp3.'\n            - '.mp4.'\n            - '.pdf.'\n            - '.png.'\n            - '.ppt.'\n            - '.pptx.'\n            - '.rtf.'\n            - '.svg.'\n            - '.txt.'\n            - '.xls.'\n            - '.xlsx.'\n    selection_exe:\n        TargetFilename|endswith:\n            - '.rar.exe'\n            - '.zip.exe'\n    # Note: If you wanna keep using the \".lnk\" extension. You might uncomment this filter and add additional locations\n    # filter_main_lnk:\n    #     TargetFilename|contains:\n    #         - '\\AppData\\Roaming\\Microsoft\\Office\\Recent\\'\n    #         - '\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\'\n    filter_icons_linux:\n        TargetFilename|startswith: '/usr/share/icons/'\n    condition: 1 of selection_* and not 1 of filter_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.007","id":"T1036.007","name":"Double File Extension","page":"techniques/enterprise/T1036.007/"}],"data_path":"data/detection-rules/b4926b47-a9d7-434c-b3a0-adc3fa0bd13e.json","kind":"sigma"}