huntrule

Windows Process Creation: Executable Extension Masquerading with .exe After Decoy Extension

Alerts on Windows processes whose paths/command lines use misleading double extensions ending in .exe to cloak executable execution.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2019-06-26
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the executable Image path ends with deceptive extension patterns such as .pdf.exe, .txt.exe, or .docx.exe, as well as variants using underscores or multiple spaces before .exe. Attackers use this masquerading to disguise an executable payload as a document or media file in spear-phishing and social engineering. Detection relies on process creation telemetry, specifically matching the process Image end-of-string and the CommandLine contents for those extension patterns.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange
Suspicious mstsc Launch of RDP File From User Download or Temp Path (via process_creation)
Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)
Possible Mamba 2FA AiTM Phishing URL Pattern
Suspicious DLL Written to Explorer IconCache Path
Suspicious DNS Query to HTML Smuggling AiTM Phishing Domain
Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)
Malicious Equation Editor Child Process Execution via process_creation
Microsoft 365 inbound suspicious email delivered to Inbox or Junk
Web Browser Opens .HTM/.HTML from Downloads Folder on Windows
Windows Process Creation: Executable Extension Masquerading with .exe After Decoy Extension
Pivot detection · T1566.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.