Suspicious Changes to File Associations: endpointEndpoint2024-11-14version:7
This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine changes to this area.
Execution of File With Spaces Before Extension: endpointEndpoint2024-11-14version:6
This search looks for processes launched from files with at least five spaces in the name before the extension. This is typically done to obfuscate the file extension by pushing it outside of the default view.
Execution of File with Multiple Extensions: endpointEndpointNoneversion:17
The following analytic detects the execution of files with multiple extensions, such as ".doc.exe" or ".pdf.exe". This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the file name contains double extensions. This activity is significant because attackers often use double extensions to disguise malicious executables as benign documents, increasing the likelihood of user execution. If confirmed malicious, this technique can lead to unauthorized code execution, potentially compromising the endpoint and allowing further malicious activities.
Windows File Association Modification via Ftype: endpointEndpointNoneversion:2
This analytic detects the use of the `ftype` command to modify Windows file associations.
Attackers can abuse this functionality to change how specific file types are handled, potentially redirecting legitimate file execution to malicious payloads.
If confirmed malicious, this behavior may enable persistence, execution of unauthorized code, or evasion of security controls.
