Skip to content

Hide Navigation Hide TOC

Suspicious Double Extension File Execution (1cdd9a09-06c9-4769-99ff-626e2b3991b8)

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

Cluster A Galaxy A Cluster B Galaxy B Level
Spearphishing Attachment - T1566.001 (2e34237d-8574-43f6-aace-ae2915de8597) Attack Pattern Suspicious Double Extension File Execution (1cdd9a09-06c9-4769-99ff-626e2b3991b8) Sigma-Rules 1
Spearphishing Attachment - T1566.001 (2e34237d-8574-43f6-aace-ae2915de8597) Attack Pattern Phishing - T1566 (a62a8db3-f23a-4d8f-afd6-9dbc77e7813b) Attack Pattern 2