Windows File Extension and Association Abuse

• Suspicious Changes to File Associations :
  endpoint Endpoint risk_score:25 2024-10-17 version:6
  This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area.


• Execution of File With Spaces Before Extension :
  endpoint Endpoint risk_score:25 2024-10-17 version:5
  This search looks for processes launched from files with at least five spaces in the name before the extension. This is typically done to obfuscate the file extension by pushing it outside of the default view.


• Execution of File with Multiple Extensions :
  endpoint Endpoint risk_score:56 2024-09-30 version:6
  The following analytic detects the execution of files with multiple extensions, such as ".doc.exe" or ".pdf.exe". This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the file name contains double extensions. This activity is significant because attackers often use double extensions to disguise malicious executables as benign documents, increasing the likelihood of user execution. If confirmed malicious, this technique can lead to unauthorized code execution, potentially compromising the endpoint and allowing further malicious activities.