Windows Process Creation: Executable Extension Masquerading with .exe After Decoy Extension

title: "Windows Process Creation: Executable Extension Masquerading with .exe After Decoy Extension"
id: 316345da-49c3-4b5a-b5c4-77d85ee65032
related:
  - id: 5e6a80c8-2d45-4633-9ef4-fa2671a39c5c
    type: similar
  - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
    type: derived
status: stable
description: This rule flags Windows process creation events where the executable Image path ends with deceptive extension patterns such as .pdf.exe, .txt.exe, or .docx.exe, as well as variants using underscores or multiple spaces before .exe. Attackers use this masquerading to disguise an executable payload as a document or media file in spear-phishing and social engineering. Detection relies on process creation telemetry, specifically matching the process Image end-of-string and the CommandLine contents for those extension patterns.
references:
  - https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html
  - https://twitter.com/blackorbird/status/1140519090961825792
  - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_double_extension.yml
author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-06-26
modified: 2025-05-30
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - "      .exe"
      - ______.exe
      - .doc.exe
      - .doc.js
      - .docx.exe
      - .docx.js
      - .gif.exe
      - .jpeg.exe
      - .jpg.exe
      - .mkv.exe
      - .mov.exe
      - .mp3.exe
      - .mp4.exe
      - .pdf.exe
      - .pdf.js
      - .png.exe
      - .ppt.exe
      - .ppt.js
      - .pptx.exe
      - .pptx.js
      - .rtf.exe
      - .rtf.js
      - .svg.exe
      - .txt.exe
      - .txt.js
      - .xls.exe
      - .xls.js
      - .xlsx.exe
      - .xlsx.js
      - ⠀⠀⠀⠀⠀⠀.exe
    CommandLine|contains:
      - "      .exe"
      - ______.exe
      - .doc.exe
      - .doc.js
      - .docx.exe
      - .docx.js
      - .gif.exe
      - .jpeg.exe
      - .jpg.exe
      - .mkv.exe
      - .mov.exe
      - .mp3.exe
      - .mp4.exe
      - .pdf.exe
      - .pdf.js
      - .png.exe
      - .ppt.exe
      - .ppt.js
      - .pptx.exe
      - .pptx.js
      - .rtf.exe
      - .rtf.js
      - .svg.exe
      - .txt.exe
      - .txt.js
      - .xls.exe
      - .xls.js
      - .xlsx.exe
      - .xlsx.js
      - ⠀⠀⠀⠀⠀⠀.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1