Windows File Creation: Suspicious .lnk Double-Extension Filenames

Alerts on Windows-created filenames that end in .lnk while containing hidden-looking double extensions (e.g., .doc. .pdf.)

FreeUnreviewedSigmamediumv1

windows-file-creation-suspicious-lnk-double-extension-filenames-3215aa19

title: "Windows File Creation: Suspicious .lnk Double-Extension Filenames"
id: 4e0f6aa5-22b5-4a67-9920-33e5c33cd66b
related:
  - id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e
    type: derived
  - id: 3215aa19-f060-4332-86d5-5602511f3ca8
    type: derived
status: test
description: This rule flags Windows file creation events where the target filename ends with “.lnk” but also contains a double-extension pattern such as “.doc.”, “.pdf.”, “.jpg.”, or Office file extensions before the final “.lnk”. Attackers may use this filename trick to mislead users or leverage Windows UI behavior that hides common extensions. The detection relies on file event telemetry that includes the created filename, plus process image path details to exclude commonly benign executions from Windows Recent and Office Recent directories.
references:
  - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
  - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
  - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
  - https://twitter.com/malwrhunterteam/status/1235135745611960321
  - https://twitter.com/luc4m/status/1073181154126254080
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2022-11-07
modified: 2023-10-18
tags:
  - attack.stealth
  - attack.t1036.007
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: .lnk
    TargetFilename|contains:
      - .doc.
      - .docx.
      - .jpg.
      - .pdf.
      - .ppt.
      - .pptx.
      - .xls.
      - .xlsx.
  filter_main_recent:
    TargetFilename|contains: \AppData\Roaming\Microsoft\Windows\Recent\
  filter_optional_office_recent:
    Image|endswith:
      - \excel.exe
      - \powerpnt.exe
      - \winword.exe
    TargetFilename|contains: \AppData\Roaming\Microsoft\Office\Recent\
  filter_optional_office_excel:
    Image|endswith: \excel.exe
    TargetFilename|contains: \AppData\Roaming\Microsoft\Excel
  filter_optional_office_powerpoint:
    Image|endswith: \powerpnt.exe
    TargetFilename|contains: \AppData\Roaming\Microsoft\PowerPoint
  filter_optional_office_word:
    Image|endswith: \winword.exe
    TargetFilename|contains: \AppData\Roaming\Microsoft\Word
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Some tuning is required for other general purpose directories of third party apps
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension/info.yml
license: DRL-1.1

What it detects

This rule flags Windows file creation events where the target filename ends with “.lnk” but also contains a double-extension pattern such as “.doc.”, “.pdf.”, “.jpg.”, or Office file extensions before the final “.lnk”. Attackers may use this filename trick to mislead users or leverage Windows UI behavior that hides common extensions. The detection relies on file event telemetry that includes the created filename, plus process image path details to exclude commonly benign executions from Windows Recent and Office Recent directories.

Known false positives

Some tuning is required for other general purpose directories of third party apps

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.