cscli scenarios install sigmahq/proc_creation_win_susp_double_extension1type: trigger2name: sigmahq/proc_creation_win_susp_double_extension3description: |4 Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '.doc.exe' || evt.Parsed.Image endsWith '.docx.exe' || evt.Parsed.Image endsWith '.xls.exe' || evt.Parsed.Image endsWith '.xlsx.exe' || evt.Parsed.Image endsWith '.ppt.exe' || evt.Parsed.Image endsWith '.pptx.exe' || evt.Parsed.Image endsWith '.rtf.exe' || evt.Parsed.Image endsWith '.pdf.exe' || evt.Parsed.Image endsWith '.txt.exe' || evt.Parsed.Image endsWith ' .exe' || evt.Parsed.Image endsWith '______.exe' || evt.Parsed.Image endsWith '.doc.js' || evt.Parsed.Image endsWith '.docx.js' || evt.Parsed.Image endsWith '.xls.js' || evt.Parsed.Image endsWith '.xlsx.js' || evt.Parsed.Image endsWith '.ppt.js' || evt.Parsed.Image endsWith '.pptx.js' || evt.Parsed.Image endsWith '.rtf.js' || evt.Parsed.Image endsWith '.pdf.js' || evt.Parsed.Image endsWith '.txt.js') && (evt.Parsed.CommandLine contains '.doc.exe' || evt.Parsed.CommandLine contains '.docx.exe' || evt.Parsed.CommandLine contains '.xls.exe' || evt.Parsed.CommandLine contains '.xlsx.exe' || evt.Parsed.CommandLine contains '.ppt.exe' || evt.Parsed.CommandLine contains '.pptx.exe' || evt.Parsed.CommandLine contains '.rtf.exe' || evt.Parsed.CommandLine contains '.pdf.exe' || evt.Parsed.CommandLine contains '.txt.exe' || evt.Parsed.CommandLine contains ' .exe' || evt.Parsed.CommandLine contains '______.exe' || evt.Parsed.CommandLine contains '.doc.js' || evt.Parsed.CommandLine contains '.docx.js' || evt.Parsed.CommandLine contains '.xls.js' || evt.Parsed.CommandLine contains '.xlsx.js' || evt.Parsed.CommandLine contains '.ppt.js' || evt.Parsed.CommandLine contains '.pptx.js' || evt.Parsed.CommandLine contains '.rtf.js' || evt.Parsed.CommandLine contains '.pdf.js' || evt.Parsed.CommandLine contains '.txt.js'))7blackhole: 2m8#status: stable9labels:10 service: windows11 confidence: 212 spoofable: 013 classification:14 - attack.t1566.0011516 label: "Suspicious Double Extension File Execution"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324