Double Extension Spoofing
Description
Double extension spoofing is a classic social engineering attack technique that cleverly exploits Windows default behavior of hiding file extensions for known file types, disguising malicious executable files as seemingly harmless documents or image files.
This technique typically names files in formats like document.pdf.exe or image.jpg.scr. When the system hides the real extension, users only see document.pdf or image.jpg, mistaking them for safe document or image files. Once users double-click to open them, the malicious program actually executes.
In enterprise environments, such attacks are commonly delivered through phishing emails, exploiting employees’ trust in familiar document formats. Due to its simple implementation yet significant effectiveness, it remains one of the initial intrusion methods frequently used by APT groups and ransomware gangs. Timely identification of such disguised files is crucial for blocking the early stages of attack chains.
Challenge Objective
Write rules to identify running processes in the system that exhibit double extension characteristics, with particular focus on execution processes that disguise themselves as common document or media file formats.
When writing detection queries, ensure the
Computerfield is included in the output for further validation.
Data Sample
Data source: Sysmon; sample data:
{ "Channel": "Microsoft-Windows-Sysmon/Operational", "CommandLine": "\"C:\\Users\\admin\\Desktop\\report.docx.exe\"", "Company": "-", "Computer": "DESKTOP-R4BGTFE", "CurrentDirectory": "C:\\Users\\admin\\Desktop\\", "Description": "-", "EventId": "1", "FileVersion": "-", "Hashes": "MD5=EC14855E209D1AE65914AF611BD717EB,SHA256=8FD730FD551A469DB21D4B685FD1B50B06A2780180B5AAE9EB22C9ADB713FF7F,IMPHASH=D42595B695FC008EF2C56AABD8EFD68E", "Image": "C:\\Users\\admin\\Desktop\\report.docx.exe", "IntegrityLevel": "Medium", "LogonGuid": "{769c9af7-93bf-686f-d893-320400000000}", "LogonId": "0x43293d8", "OriginalFileName": "-", "ParentCommandLine": "\"C:\\Windows\\explorer.exe\" /LOADSAVEDWINDOWS", "ParentImage": "C:\\Windows\\explorer.exe", "ParentProcessGuid": "{769c9af7-2950-6890-597d-000000000a00}", "ParentProcessId": "8468", "ParentUser": "DESKTOP-R4BGTFE\\admin", "ProcessGuid": "{769c9af7-2c8d-6890-b37d-000000000a00}", "ProcessId": "9596", "Product": "-", "RuleName": "-", "SystemTime": "2025-08-04T03:44:13.6683024Z", "TerminalSessionId": "2", "User": "DESKTOP-R4BGTFE\\admin", "UtcTime": "2025-08-04 03:44:13.645",}References
Fields
No fields found