Windows File Creation: Suspicious Double-Extension Filenames Ending in Script/Archive/Executable Types
Alerts on Windows filenames that look like double extensions, including .rar.exe/.zip.exe masquerading patterns.
FreeReviewedSigma · High · v6
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-06-19
- Updated
- 2026-10-16
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies file creation events where the target filename contains a known document/media/data extension followed by a second executable or archive/script-like extension (e.g., .pdf.exe, .docx.bat, .png.vbs). Double extensions are commonly used to mislead users and leverage Windows default extension-hiding behavior, potentially supporting malware delivery and execution. Detection relies on Windows file event telemetry capturing the TargetFilename string and filters out specific benign double-extension patterns and optional icon-path traffic.
Reporting behind it
- crowdstrike.comhttps://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
- anomali.comhttps://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
- cybereason.comhttps://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
- twitter.comhttps://twitter.com/malwrhunterteam/status/1235135745611960321
- twitter.comhttps://twitter.com/luc4m/status/1073181154126254080
- cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
- vipre.comhttps://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_double_extension.yml
Changelog
v6- v6Candidate ingested via manual entry.2026-10-16
- v5Candidate ingested via manual entry.2026-10-13
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-events-suspicious-double-extension-filenames-b4926b47
title: "Windows File Creation: Suspicious Double-Extension Filenames Ending in Script/Archive/Executable Types"
id: 4575c15c-7a7a-4db0-8ac2-e0418c8f9023
related:
- id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
type: derived
- id: 3215aa19-f060-4332-86d5-5602511f3ca8
type: similar
- id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e
type: derived
status: test
description: This rule identifies file creation events where the target filename contains a known document/media/data extension followed by a second executable or archive/script-like extension (e.g., .pdf.exe, .docx.bat, .png.vbs). Double extensions are commonly used to mislead users and leverage Windows default extension-hiding behavior, potentially supporting malware delivery and execution. Detection relies on Windows file event telemetry capturing the TargetFilename string and filters out specific benign double-extension patterns and optional icon-path traffic.
references:
- https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
- https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
- https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
- https://twitter.com/malwrhunterteam/status/1235135745611960321
- https://twitter.com/luc4m/status/1073181154126254080
- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
- https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_double_extension.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2022-06-19
modified: 2026-10-16
tags:
- attack.stealth
- attack.t1036.007
logsource:
category: file_event
product: windows
detection:
selection_gen:
TargetFilename|re|i: \.(docx?|gif|jpe?g|mp3|mp4|pdf|png|pptx?|rtf|svg|txt|xlsx?)\.(bat|exe|iso|rar|svg|vbe|vbs|zip)$
selection_exe:
TargetFilename|endswith:
- .rar.exe
- .zip.exe
filter_main_legitimate_extensions:
TargetFilename|endswith:
- .svg.svg
- .png.svg
- .jpg.svg
- .jpeg.svg
filter_optional_icons_linux:
TargetFilename|startswith: /usr/share/icons/
condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unlikely
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_double_extension/info.yml
license: DRL-1.1