Detection of Suspicious Double Extension File Names

Threat actors, including groups like Mustang Panda and operators of the BazarLoader malware, utilize file masquerading techniques to deceive users into executing malicious binaries. By crafting filenames with double extensions (e.g., 'document.pdf.exe'), attackers take advantage of the default Windows configuration that hides known file extensions from the user interface. This makes a malicious executable appear as a harmless document or media file. The technique is frequently used in spear-phishing campaigns to deliver payloads, such as droppers or remote access trojans (RATs). Detection engineering teams should monitor for the creation of files with mismatched or dual-extension patterns, as this is a high-fidelity indicator of social engineering and malicious intent.

Impact

Successful execution of these files leads to unauthorized code execution, potential establishment of persistence, and subsequent compromise of host systems. Observed campaigns targeting government, private sector, and minority groups demonstrate that this technique is a reliable vector for gaining initial access to sensitive environments.

Recommendation

1. Deploy the provided Sigma rule to your SIEM/EDR to monitor for file creation events that match suspicious double-extension patterns.
2. Implement Group Policy settings to "Show file extensions" globally, reducing the efficacy of this masquerading technique for end-users.
3. Configure endpoint security solutions to alert on or block files that use high-risk combinations like '.zip.exe' or '.rar.exe' which are explicitly designed for evasion.
4. Use the file_event logs to baseline common legitimate software update patterns to tune out noise and reduce false positives in highly dynamic environments.