Suspicious Double Extension File Execution

Severity: high
Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566.001` Phishing: Spearphishing Attachment

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection`

or:
CommandLine|contains: '      .exe'
CommandLine|contains: .doc.exe
CommandLine|contains: .doc.js
CommandLine|contains: .docx.exe
CommandLine|contains: .docx.js
CommandLine|contains: .gif.exe
CommandLine|contains: .jpeg.exe
CommandLine|contains: .jpg.exe
CommandLine|contains: .mkv.exe
CommandLine|contains: .mov.exe
CommandLine|contains: .mp3.exe
CommandLine|contains: .mp4.exe
CommandLine|contains: .pdf.exe
CommandLine|contains: .pdf.js
CommandLine|contains: .png.exe
CommandLine|contains: .ppt.exe
CommandLine|contains: .ppt.js
CommandLine|contains: .pptx.exe
CommandLine|contains: .pptx.js
CommandLine|contains: .rtf.exe
CommandLine|contains: .rtf.js
CommandLine|contains: .svg.exe
CommandLine|contains: .txt.exe
CommandLine|contains: .txt.js
CommandLine|contains: .xls.exe
CommandLine|contains: .xls.js
CommandLine|contains: .xlsx.exe
CommandLine|contains: .xlsx.js
CommandLine|contains: ______.exe
CommandLine|contains: '⠀⠀⠀⠀⠀⠀.exe'
or:
Image|endswith: '      .exe'
Image|endswith: .doc.exe
Image|endswith: .doc.js
Image|endswith: .docx.exe
Image|endswith: .docx.js
Image|endswith: .gif.exe
Image|endswith: .jpeg.exe
Image|endswith: .jpg.exe
Image|endswith: .mkv.exe
Image|endswith: .mov.exe
Image|endswith: .mp3.exe
Image|endswith: .mp4.exe
Image|endswith: .pdf.exe
Image|endswith: .pdf.js
Image|endswith: .png.exe
Image|endswith: .ppt.exe
Image|endswith: .ppt.js
Image|endswith: .pptx.exe
Image|endswith: .pptx.js
Image|endswith: .rtf.exe
Image|endswith: .rtf.js
Image|endswith: .svg.exe
Image|endswith: .txt.exe
Image|endswith: .txt.js
Image|endswith: .xls.exe
Image|endswith: .xls.js
Image|endswith: .xlsx.exe
Image|endswith: .xlsx.js
Image|endswith: ______.exe
Image|endswith: '⠀⠀⠀⠀⠀⠀.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.