huntrule

Suspicious Execution of Renamed Data File with Double Extension via STOCKSTAY (via process_creation)

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-05-22
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects execution of an image whose name ends in a data-to-executable double extension such as .dat.exe, matching the STOCKSTAY chain where an HTA renamed a styles.dat payload to styles.dat.exe and ran it through WScript.Shell. Adversaries use double extensions to disguise executable payloads as inert data files, so running such a file is a strong masquerading indicator.

Reporting behind it

Related detections9 linkedT1218.005 — drag to rearrange
Suspicious PowerShell Spawned by mshta.exe in FakeSG Chain (via process_creation)
Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)
Suspicious Hidden PowerShell Spawned by MSHTA for Boot Persistence (via process_creation)
Malicious HTA Payload Download and Execution via PowerShell One-Liner (via process_creation)
Suspicious PowerShell In-Memory Execution with AES Decryption
Suspicious Encoded PowerShell Command Execution
Suspicious RunMRU Entry Launching LOLBIN via ClickFix Run Dialog
Suspicious mshta Executing Remote Content via ClickFix Lure
Suspicious node.exe Executing Compiled JavaScript Bytecode File
Suspicious Execution of Renamed Data File with Double Extension via STOCKSTAY (via process_creation)
Pivot detection · T1218.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.