Sigma rule: Suspicious Double Extension Files

Rule

Title

Suspicious Double Extension Files

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), frack113

Date

2022-06-19

Modified

2026-10-16

File

rules/windows/file/file_event/file_event_win_susp_double_extension.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.

Log source

product

windows

category

file_event

Detection

selection_gen:
    TargetFilename|re|i: '\.(docx?|gif|jpe?g|mp3|mp4|pdf|png|pptx?|rtf|svg|txt|xlsx?)\.(bat|exe|iso|rar|svg|vbe|vbs|zip)$'
selection_exe:
    TargetFilename|endswith:
        - '.rar.exe'
        - '.zip.exe'
# Note: If you wanna keep using the ".lnk" extension. You might uncomment this filter and add additional locations
# filter_main_lnk:
#     TargetFilename|contains:
#         - '\AppData\Roaming\Microsoft\Office\Recent\'
#         - '\AppData\Roaming\Microsoft\Windows\Recent\'
filter_main_legitimate_extensions:
    TargetFilename|endswith:
        - '.svg.svg'
        - '.png.svg'
        - '.jpg.svg'
        - '.jpeg.svg'
filter_optional_icons_linux:
    TargetFilename|startswith: '/usr/share/icons/'
condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.stealth
• attack.t1036.007

MITRE ATT&CK ids this rule names

• T1036.007

Related rules

• 1cdd9a09-06c9-4769-99ff-626e2b3991b8 (derived)
• 3215aa19-f060-4332-86d5-5602511f3ca8 (similar)

References

• https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
• https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
• https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
• https://twitter.com/malwrhunterteam/status/1235135745611960321
• https://twitter.com/luc4m/status/1073181154126254080
• https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
• https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_susp_double_extension.yml