Sigma rule: Suspicious LNK Double Extension File Created

Rule

Title

Suspicious LNK Double Extension File Created

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems), frack113

Date

2022-11-07

Modified

2023-10-18

File

rules/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|endswith: '.lnk'
    TargetFilename|contains:
        - '.doc.'
        - '.docx.'
        - '.jpg.'
        - '.pdf.'
        - '.ppt.'
        - '.pptx.'
        - '.xls.'
        - '.xlsx.'
filter_main_recent:
    TargetFilename|contains: '\AppData\Roaming\Microsoft\Windows\Recent\'
filter_optional_office_recent:
    Image|endswith:
        # Note: Some additional office application might need to be added
        - '\excel.exe'
        - '\powerpnt.exe'
        - '\winword.exe'
    TargetFilename|contains: '\AppData\Roaming\Microsoft\Office\Recent\'
filter_optional_office_excel:
    Image|endswith: '\excel.exe'
    TargetFilename|contains: '\AppData\Roaming\Microsoft\Excel'
filter_optional_office_powerpoint:
    Image|endswith: '\powerpnt.exe'
    TargetFilename|contains: '\AppData\Roaming\Microsoft\PowerPoint'
filter_optional_office_word:
    Image|endswith: '\winword.exe'
    TargetFilename|contains: '\AppData\Roaming\Microsoft\Word'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Some tuning is required for other general purpose directories of third party apps

Tags

• attack.stealth
• attack.t1036.007

MITRE ATT&CK ids this rule names

• T1036.007

Related rules

• b4926b47-a9d7-434c-b3a0-adc3fa0bd13e (derived)

References

• https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
• https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
• https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
• https://twitter.com/malwrhunterteam/status/1235135745611960321
• https://twitter.com/luc4m/status/1073181154126254080

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml