Suspicious Parent Double Extension File Execution

Title: Suspicious Parent Double Extension File Execution
Status: test
Description:Detect execution of suspicious double extension files in ParentCommandLine
References:
  -https://www.virustotal.com/gui/file/7872d8845a332dce517adae9c3389fde5313ff2fed38c2577f3b498da786db68/behavior
  -https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-06
modified:2023-02-28
Tags:

• -'attack.stealth'
• -'attack.t1036.007'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    - ParentImage|endswith:
      - '.doc.lnk'
      - '.docx.lnk'
      - '.xls.lnk'
      - '.xlsx.lnk'
      - '.ppt.lnk'
      - '.pptx.lnk'
      - '.rtf.lnk'
      - '.pdf.lnk'
      - '.txt.lnk'
      - '.doc.js'
      - '.docx.js'
      - '.xls.js'
      - '.xlsx.js'
      - '.ppt.js'
      - '.pptx.js'
      - '.rtf.js'
      - '.pdf.js'
      - '.txt.js'
    - ParentCommandLine|contains:
      - '.doc.lnk'
      - '.docx.lnk'
      - '.xls.lnk'
      - '.xlsx.lnk'
      - '.ppt.lnk'
      - '.pptx.lnk'
      - '.rtf.lnk'
      - '.pdf.lnk'
      - '.txt.lnk'
      - '.doc.js'
      - '.docx.js'
      - '.xls.js'
      - '.xlsx.js'
      - '.ppt.js'
      - '.pptx.js'
      - '.rtf.js'
      - '.pdf.js'
      - '.txt.js'
  condition:selection
Falsepositives:
  -Unknown
Level: high