Suspicious Double Extension File Execution Patterns

Attackers frequently employ deceptive naming conventions to facilitate the execution of malicious payloads, particularly in spearphishing campaigns. By appending non-executable extensions - such as .pdf, .docx, or .jpg - followed by an actual executable extension like .exe or .js, adversaries aim to exploit user reliance on visible file extensions to mask the true nature of a malicious file. In some cases, attackers use excessive whitespace, underscores, or Unicode characters (e.g., the Braille Pattern Blank) to push the actual extension outside the default Windows Explorer view. This technique is designed to bypass basic user scrutiny when attachments are downloaded and opened. Detection engineering teams should focus on process creation events where the image path or command line arguments contain these specific deceptive patterns, as they are rarely used by legitimate enterprise software.

Attack Chain

1. Attacker prepares a malicious binary disguised with a double extension (e.g., invoice.pdf.exe).
2. Attacker hosts the file on an infrastructure site or embeds it within an email attachment.
3. Victim receives the file and, due to the deceptive name, perceives it as a benign document.
4. Victim executes the file via the Windows shell (explorer.exe).
5. The Windows process creation event captures the execution path.
6. The malicious process launches, potentially initiating secondary payload download or system enumeration.
7. Final objective is achieved, such as credential theft, ransomware deployment, or data exfiltration.

Impact

This technique facilitates unauthorized code execution on victim endpoints. If successful, it allows attackers to establish persistent access, conduct reconnaissance within the internal network, and exfiltrate sensitive data. These campaigns often target a broad range of sectors, focusing on users who regularly handle external documents.

Recommendation

1. Deploy the provided Sigma rule to detect process creation events containing common deceptive filename patterns.
2. Enable Sysmon Event ID 1 (Process Creation) to gain visibility into the 'Image' and 'CommandLine' fields necessary for identifying these patterns.
3. Perform threat hunting across existing logs for files executing with the identified deceptive suffixes.
4. Implement security awareness training to educate users on Windows file extension visibility settings.