Sigma rule: Suspicious Appended Extension

Rule

Title

Suspicious Appended Extension

Status

test

Level

medium

Author

frack113

Date

2022-07-16

Modified

2023-11-11

File

rules/windows/file/file_rename/file_rename_win_ransomware.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.

Log source

product

windows

category

file_rename

definition

Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword

Detection

selection:
    SourceFilename|endswith:
        - '.doc'
        - '.docx'
        - '.jpeg'
        - '.jpg'
        - '.lnk'
        - '.pdf'
        - '.png'
        - '.pst'
        - '.rtf'
        - '.xls'
        - '.xlsx'
    TargetFilename|contains:
        - '.doc.'
        - '.docx.'
        - '.jpeg.'
        - '.jpg.'
        - '.lnk.'
        - '.pdf.'
        - '.png.'
        - '.pst.'
        - '.rtf.'
        - '.xls.'
        - '.xlsx.'
filter_main_generic:
    TargetFilename|endswith:
        # Note: Please add more used extensions by backup or recovery software
        - '.backup'
        - '.bak'
        - '.old'
        - '.orig'
        - '.temp'
        - '.tmp'
filter_optional_anaconda:
    TargetFilename|contains: ':\ProgramData\Anaconda3\'
    TargetFilename|endswith: '.c~'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Backup software

Tags

• attack.impact
• attack.t1486

MITRE ATT&CK ids this rule names

• T1486

References

• https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/
• https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_rename/file_rename_win_ransomware.yml