huntrule

Windows Suspicious Double-Extension Execution via Parent Command Line

Alerts on Windows processes launched by parents whose image/command line includes disguised double-extension tokens.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-01-06
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation where the parent image ends with document/script-like double extensions (e.g., .doc.lnk, .doc.js) or the parent command line contains those same double-extension tokens. Double extension artifacts are commonly used to disguise the true execution target and entice users to run attacker-controlled content. The detection relies on process creation telemetry, specifically the parent process image path and the parent command line content observed on the host.

Reporting behind it

Related detections7 linkedT1036.007 — drag to rearrange
Suspicious Double Extension docx Executable Execution (via process_creation)
Suspicious MSC File with Double Extension (via file_event)
Suspicious MSHTA Execution of Polyglot PDF File Spawned by cmd (via process_creation)
Masquerading Noodlophile Payload Execution via Video File Double Extension (via process_creation)
Suspicious Double Extension PDF Executable via Process Creation
Windows File Creation: Suspicious LNK Double-Extension Targeted by Document/Image Prefixes
Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)
Windows Suspicious Double-Extension Execution via Parent Command Line
Pivot detection · T1036.007 · 7 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.