Suspicious Double Extension File Execution

Title: Suspicious Double Extension File Execution
Status: stable
Description:Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns
References:
  -https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html
  -https://twitter.com/blackorbird/status/1140519090961825792
  -https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)
Date: 2019-06-26
modified:2025-05-30
Tags:

• -'attack.initial-access'
• -'attack.t1566.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith:
      -' .exe'
      -'______.exe'
      -'.doc.exe'
      -'.doc.js'
      -'.docx.exe'
      -'.docx.js'
      -'.gif.exe'
      -'.jpeg.exe'
      -'.jpg.exe'
      -'.mkv.exe'
      -'.mov.exe'
      -'.mp3.exe'
      -'.mp4.exe'
      -'.pdf.exe'
      -'.pdf.js'
      -'.png.exe'
      -'.ppt.exe'
      -'.ppt.js'
      -'.pptx.exe'
      -'.pptx.js'
      -'.rtf.exe'
      -'.rtf.js'
      -'.svg.exe'
      -'.txt.exe'
      -'.txt.js'
      -'.xls.exe'
      -'.xls.js'
      -'.xlsx.exe'
      -'.xlsx.js'
      -'⠀⠀⠀⠀⠀⠀.exe'

    CommandLine|contains:
      -' .exe'
      -'______.exe'
      -'.doc.exe'
      -'.doc.js'
      -'.docx.exe'
      -'.docx.js'
      -'.gif.exe'
      -'.jpeg.exe'
      -'.jpg.exe'
      -'.mkv.exe'
      -'.mov.exe'
      -'.mp3.exe'
      -'.mp4.exe'
      -'.pdf.exe'
      -'.pdf.js'
      -'.png.exe'
      -'.ppt.exe'
      -'.ppt.js'
      -'.pptx.exe'
      -'.pptx.js'
      -'.rtf.exe'
      -'.rtf.js'
      -'.svg.exe'
      -'.txt.exe'
      -'.txt.js'
      -'.xls.exe'
      -'.xls.js'
      -'.xlsx.exe'
      -'.xlsx.js'
      -'⠀⠀⠀⠀⠀⠀.exe'

  condition:selection
Falsepositives:
  -Unknown
Level: high