Windows Suspicious Double-Extension Execution via Parent Command Line

Alerts on Windows processes launched by parents whose image/command line includes disguised double-extension tokens.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-01-06
Updated: 2026-07-30

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.007Double File Extension
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation where the parent image ends with document/script-like double extensions (e.g., .doc.lnk, .doc.js) or the parent command line contains those same double-extension tokens. Double extension artifacts are commonly used to disguise the true execution target and entice users to run attacker-controlled content. The detection relies on process creation telemetry, specifically the parent process image path and the parent command line content observed on the host.

Reporting behind it

Related detections7 linkedT1036.007 — drag to rearrange

Suspicious Double Extension docx Executable Execution (via process_creation)

Suspicious MSC File with Double Extension (via file_event)

Suspicious MSHTA Execution of Polyglot PDF File Spawned by cmd (via process_creation)

Masquerading Noodlophile Payload Execution via Video File Double Extension (via process_creation)

Suspicious Double Extension PDF Executable via Process Creation

Windows File Creation: Suspicious LNK Double-Extension Targeted by Document/Image Prefixes

Windows File Events: Flag Files With Double Extensions (e.g., .docx.exe)

Windows Suspicious Double-Extension Execution via Parent Command Line

Pivot detection · T1036.007 · 7 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-double-extension-execution-via-parent-command-line-5e6a80c8

title: Windows Suspicious Double-Extension Execution via Parent Command Line
id: f76b98f5-da0f-4641-814a-fb4a47898dc8
related:
  - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
    type: derived
  - id: 5e6a80c8-2d45-4633-9ef4-fa2671a39c5c
    type: derived
status: test
description: This rule flags Windows process creation where the parent image ends with document/script-like double extensions (e.g., .doc.lnk, .doc.js) or the parent command line contains those same double-extension tokens. Double extension artifacts are commonly used to disguise the true execution target and entice users to run attacker-controlled content. The detection relies on process creation telemetry, specifically the parent process image path and the parent command line content observed on the host.
references:
  - https://www.virustotal.com/gui/file/7872d8845a332dce517adae9c3389fde5313ff2fed38c2577f3b498da786db68/behavior
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_double_extension_parent.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-06
modified: 2023-02-28
tags:
  - attack.stealth
  - attack.t1036.007
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - ParentImage|endswith:
        - .doc.lnk
        - .docx.lnk
        - .xls.lnk
        - .xlsx.lnk
        - .ppt.lnk
        - .pptx.lnk
        - .rtf.lnk
        - .pdf.lnk
        - .txt.lnk
        - .doc.js
        - .docx.js
        - .xls.js
        - .xlsx.js
        - .ppt.js
        - .pptx.js
        - .rtf.js
        - .pdf.js
        - .txt.js
    - ParentCommandLine|contains:
        - .doc.lnk
        - .docx.lnk
        - .xls.lnk
        - .xlsx.lnk
        - .ppt.lnk
        - .pptx.lnk
        - .rtf.lnk
        - .pdf.lnk
        - .txt.lnk
        - .doc.js
        - .docx.js
        - .xls.js
        - .xlsx.js
        - .ppt.js
        - .pptx.js
        - .rtf.js
        - .pdf.js
        - .txt.js
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL