Windows File Events: Suspicious Double-Extension Filenames

title: "Windows File Events: Suspicious Double-Extension Filenames"
id: 4575c15c-7a7a-4db0-8ac2-e0418c8f9023
related:
  - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
    type: derived
  - id: 3215aa19-f060-4332-86d5-5602511f3ca8
    type: similar
  - id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e
    type: derived
status: test
description: This rule flags Windows file creation or write events where the target filename ends with common executable or archive extensions and also contains an additional dot-delimited extension segment (e.g., .pdf., .docx., .png.). It also specifically catches cases where filenames end with .rar.exe or .zip.exe, which attackers use to masquerade harmful payloads as documents, media, or archives. Detection relies on file event telemetry containing the full TargetFilename string, which is used to match the double-extension patterns.
references:
  - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
  - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
  - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
  - https://twitter.com/malwrhunterteam/status/1235135745611960321
  - https://twitter.com/luc4m/status/1073181154126254080
  - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
  - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_double_extension.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2022-06-19
modified: 2026-03-31
tags:
  - attack.stealth
  - attack.t1036.007
logsource:
  category: file_event
  product: windows
detection:
  selection_gen:
    TargetFilename|endswith:
      - .exe
      - .iso
      - .rar
      - .svg
      - .zip
    TargetFilename|contains:
      - .doc.
      - .docx.
      - .gif.
      - .jpeg.
      - .jpg.
      - .mp3.
      - .mp4.
      - .pdf.
      - .png.
      - .ppt.
      - .pptx.
      - .rtf.
      - .svg.
      - .txt.
      - .xls.
      - .xlsx.
  selection_exe:
    TargetFilename|endswith:
      - .rar.exe
      - .zip.exe
  filter_icons_linux:
    TargetFilename|startswith: /usr/share/icons/
  condition: 1 of selection_* and not 1 of filter_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1