Suspicious Double Extension Files

01

description

What this is, in brief.

Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.

02

rule source (YAML)

title: Suspicious Double Extension Files
id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e
related:
    - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
      type: derived
    - id: 3215aa19-f060-4332-86d5-5602511f3ca8
      type: similar
status: test
description: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.
references:
    - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
    - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
    - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
    - https://twitter.com/malwrhunterteam/status/1235135745611960321
    - https://twitter.com/luc4m/status/1073181154126254080
    - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
    - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
author: Nasreddine Bencherchali (Nextron Systems), frack113
date: 2022-06-19
modified: 2026-10-16
tags:
    - attack.stealth
    - attack.t1036.007
logsource:
    category: file_event
    product: windows
detection:
    selection_gen:
        TargetFilename|re|i: '\.(docx?|gif|jpe?g|mp3|mp4|pdf|png|pptx?|rtf|svg|txt|xlsx?)\.(bat|exe|iso|rar|svg|vbe|vbs|zip)$'
    selection_exe:
        TargetFilename|endswith:
            - '.rar.exe'
            - '.zip.exe'
    # Note: If you wanna keep using the ".lnk" extension. You might uncomment this filter and add additional locations
    # filter_main_lnk:
    #     TargetFilename|contains:
    #         - '\AppData\Roaming\Microsoft\Office\Recent\'
    #         - '\AppData\Roaming\Microsoft\Windows\Recent\'
    filter_main_legitimate_extensions:
        TargetFilename|endswith:
            - '.svg.svg'
            - '.png.svg'
            - '.jpg.svg'
            - '.jpeg.svg'
    filter_optional_icons_linux:
        TargetFilename|startswith: '/usr/share/icons/'
    condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_double_extension/info.yml

04

detects techniques (1)

ATT&CK techniques this enables or maps to.

T1036.007Double File Extension

05

references

External citations — patches, advisories, analysis.