Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)
Alerts on Windows filenames that look like double extensions, including .rar.exe/.zip.exe masquerading patterns.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-06-19
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file creation or rename events where the target filename matches patterns consistent with double extensions, such as ending in executable archive/document types or containing an additional extension marker (e.g., '.pdf.' or '.docx.'). Attackers use double extensions to disguise executable or risky content, taking advantage of default Windows behaviors that may hide known file extensions. The detection relies on file event telemetry that includes the full target filename, including its suffix and embedded extension-like segments, and excludes icon-path noise under '/usr/share/icons/'.
Reporting behind it
- crowdstrike.comhttps://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
- anomali.comhttps://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
- cybereason.comhttps://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
- twitter.comhttps://twitter.com/malwrhunterteam/status/1235135745611960321
- twitter.comhttps://twitter.com/luc4m/status/1073181154126254080
- cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
- vipre.comhttps://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_double_extension.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)"
id: 4575c15c-7a7a-4db0-8ac2-e0418c8f9023
related:
- id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
type: derived
- id: 3215aa19-f060-4332-86d5-5602511f3ca8
type: similar
- id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e
type: derived
status: test
description: This rule flags Windows file creation or rename events where the target filename matches patterns consistent with double extensions, such as ending in executable archive/document types or containing an additional extension marker (e.g., '.pdf.' or '.docx.'). Attackers use double extensions to disguise executable or risky content, taking advantage of default Windows behaviors that may hide known file extensions. The detection relies on file event telemetry that includes the full target filename, including its suffix and embedded extension-like segments, and excludes icon-path noise under '/usr/share/icons/'.
references:
- https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
- https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
- https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
- https://twitter.com/malwrhunterteam/status/1235135745611960321
- https://twitter.com/luc4m/status/1073181154126254080
- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
- https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_double_extension.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2022-06-19
modified: 2026-03-31
tags:
- attack.stealth
- attack.t1036.007
logsource:
category: file_event
product: windows
detection:
selection_gen:
TargetFilename|endswith:
- .exe
- .iso
- .rar
- .svg
- .zip
TargetFilename|contains:
- .doc.
- .docx.
- .gif.
- .jpeg.
- .jpg.
- .mp3.
- .mp4.
- .pdf.
- .png.
- .ppt.
- .pptx.
- .rtf.
- .svg.
- .txt.
- .xls.
- .xlsx.
selection_exe:
TargetFilename|endswith:
- .rar.exe
- .zip.exe
filter_icons_linux:
TargetFilename|startswith: /usr/share/icons/
condition: 1 of selection_* and not 1 of filter_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1