Executable run from a file name carrying a benign extension before it

Siemphony@siemphonymediumT1036.007unverifiedPlaybook · Defence evasion

AN1033 describes a file whose visible extension looks benign (.txt, .jpg, .pdf) but whose true, trailing extension is dangerous (.exe, .scr), then executed. This rule authors the execution half of that chain on Sysmon process creation: `selection_benign_marker` requires the image path to contain one of a benign-extension list — MITRE's `benign_extensions` knob, but the brief names only four examples (.txt, .jpg, .doc, .pdf), so the twelve further entries here (.jpeg, .png, .gif, .docx, .xls, .xlsx, .ppt, .pptx, .csv, .zip, .mp3, .mp4) are this pipeline's extrapolation, not MITRE's — immediately followed by another dot, and `selection_dangerous` requires the path to end in one of a dangerous-extension list — MITRE's `dangerous_extensions` knob, populated here with its own four named examples (.exe, .scr, .hta, .lnk) plus seven more this pipeline added (.bat, .cmd, .vbs, .js, .jar, .msi, .ps1). Both conditions together mean the image path contains a benign-looking extension sitting directly in front of the real one — the exact double-extension shape MITRE names, e.g. `Invoice_Q3.pdf.scr`. Two things this rule does not attempt. First, it does not use the Sysmon EventID 11 file-creation leg the analytic also offers: file creation alone cannot distinguish a double-extension drop from any other file write, so the signal only becomes distinct at the point of execution, which is where this rule sits. Second, it does not gate on MITRE's `monitored_paths` knob (Downloads, %TEMP%, Desktop) or the `TimeWindow`/`UserContext` knobs — narrowing to those paths would miss a payload run from anywhere else, and this pipeline has no source for a create-then-execute time correlation, since lib/sigma has no timeframe or aggregation support. The result is a path-agnostic rule that depends entirely on the double-extension shape of the name. Sysmon is not present on a default Windows install and needs a ProcessCreate rule configured; without it the rule returns nothing, which reads as quiet rather than blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0366, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Executable run from a file name carrying a benign extension before it2id: f32a56da-31db-471e-8ca8-5ada99a604863status: experimental4description: |5  AN1033 describes a file whose visible extension looks benign (.txt, .jpg,6  .pdf) but whose true, trailing extension is dangerous (.exe, .scr), then7  executed. This rule authors the execution half of that chain on Sysmon8  process creation: `selection_benign_marker` requires the image path to9  contain one of a benign-extension list — MITRE's `benign_extensions` knob,10  but the brief names only four examples (.txt, .jpg, .doc, .pdf), so the11  twelve further entries here (.jpeg, .png, .gif, .docx, .xls, .xlsx, .ppt,12  .pptx, .csv, .zip, .mp3, .mp4) are this pipeline's extrapolation, not13  MITRE's — immediately followed by another dot, and `selection_dangerous`14  requires the path to end in one of a dangerous-extension list — MITRE's15  `dangerous_extensions` knob, populated here with its own four named16  examples (.exe, .scr, .hta, .lnk) plus seven more this pipeline added17  (.bat, .cmd, .vbs, .js, .jar, .msi, .ps1). Both conditions together mean the image path18  contains a benign-looking extension sitting directly in front of the real19  one — the exact double-extension shape MITRE names, e.g.20  `Invoice_Q3.pdf.scr`. Two things this rule does not attempt. First, it21  does not use the Sysmon EventID 11 file-creation leg the analytic also22  offers: file creation alone cannot distinguish a double-extension drop23  from any other file write, so the signal only becomes distinct at the24  point of execution, which is where this rule sits. Second, it does not25  gate on MITRE's `monitored_paths` knob (Downloads, %TEMP%, Desktop) or the26  `TimeWindow`/`UserContext` knobs — narrowing to those paths would miss a27  payload run from anywhere else, and this pipeline has no source for a28  create-then-execute time correlation, since lib/sigma has no timeframe or29  aggregation support. The result is a path-agnostic rule that depends30  entirely on the double-extension shape of the name. Sysmon is not present31  on a default Windows install and needs a ProcessCreate rule configured;32  without it the rule returns nothing, which reads as quiet rather than33  blind.34  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0366, not hand-written and not tested by its author. Any lab result is on this rule's own page.35references:36  - https://attack.mitre.org/techniques/T1036/00737  - https://attack.mitre.org/detectionstrategies/DET036638author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)39date: 2026-08-1740tags:41  - attack.defense-evasion42  - attack.t1036.00743logsource:44  category: process_creation45  product: windows46detection:47  selection_benign_marker:48    Image|contains:49      - '.txt.'50      - '.jpg.'51      - '.jpeg.'52      - '.png.'53      - '.gif.'54      - '.pdf.'55      - '.doc.'56      - '.docx.'57      - '.xls.'58      - '.xlsx.'59      - '.ppt.'60      - '.pptx.'61      - '.csv.'62      - '.zip.'63      - '.mp3.'64      - '.mp4.'65  selection_dangerous:66    Image|endswith:67      - '.exe'68      - '.scr'69      - '.hta'70      - '.lnk'71      - '.bat'72      - '.cmd'73      - '.vbs'74      - '.js'75      - '.jar'76      - '.msi'77      - '.ps1'78  condition: selection_benign_marker and selection_dangerous79falsepositives:80  - "Self-extracting archive installers and vendor demo or kiosk bundles that describe their payload in the file name ahead of the .exe wrapper, e.g. Catalog.pdf.exe or Presentation.pptx.exe — a naming convention some trade-show and marketing software vendors use deliberately for descriptive SFX installers."81  - "Email-security and sandbox or detonation tooling that renames a quarantined attachment by appending its original extension in front of the tool's own wrapper extension, such as invoice.pdf.exe, before re-executing the wrapper inside an isolated analysis chamber."82  - "Backup, versioning or migration tools that stage a renamed copy of an executable payload with a descriptive extension chain, for example when a packaging step writes install.msi.exe as an intermediate artefact and then runs it directly."83level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath contains ".txt." or FolderPath contains ".jpg." or FolderPath contains ".jpeg." or FolderPath contains ".png." or FolderPath contains ".gif." or FolderPath contains ".pdf." or FolderPath contains ".doc." or FolderPath contains ".docx." or FolderPath contains ".xls." or FolderPath contains ".xlsx." or FolderPath contains ".ppt." or FolderPath contains ".pptx." or FolderPath contains ".csv." or FolderPath contains ".zip." or FolderPath contains ".mp3." or FolderPath contains ".mp4.") and (FolderPath endswith ".exe" or FolderPath endswith ".scr" or FolderPath endswith ".hta" or FolderPath endswith ".lnk" or FolderPath endswith ".bat" or FolderPath endswith ".cmd" or FolderPath endswith ".vbs" or FolderPath endswith ".js" or FolderPath endswith ".jar" or FolderPath endswith ".msi" or FolderPath endswith ".ps1"))

Splunk · SPL

Run this as a search.

index=* ((Image="*.txt.*" OR Image="*.jpg.*" OR Image="*.jpeg.*" OR Image="*.png.*" OR Image="*.gif.*" OR Image="*.pdf.*" OR Image="*.doc.*" OR Image="*.docx.*" OR Image="*.xls.*" OR Image="*.xlsx.*" OR Image="*.ppt.*" OR Image="*.pptx.*" OR Image="*.csv.*" OR Image="*.zip.*" OR Image="*.mp3.*" OR Image="*.mp4.*") AND (Image="*.exe" OR Image="*.scr" OR Image="*.hta" OR Image="*.lnk" OR Image="*.bat" OR Image="*.cmd" OR Image="*.vbs" OR Image="*.js" OR Image="*.jar" OR Image="*.msi" OR Image="*.ps1"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*.txt.*" OR TO_LOWER(process.executable) LIKE "*.jpg.*" OR TO_LOWER(process.executable) LIKE "*.jpeg.*" OR TO_LOWER(process.executable) LIKE "*.png.*" OR TO_LOWER(process.executable) LIKE "*.gif.*" OR TO_LOWER(process.executable) LIKE "*.pdf.*" OR TO_LOWER(process.executable) LIKE "*.doc.*" OR TO_LOWER(process.executable) LIKE "*.docx.*" OR TO_LOWER(process.executable) LIKE "*.xls.*" OR TO_LOWER(process.executable) LIKE "*.xlsx.*" OR TO_LOWER(process.executable) LIKE "*.ppt.*" OR TO_LOWER(process.executable) LIKE "*.pptx.*" OR TO_LOWER(process.executable) LIKE "*.csv.*" OR TO_LOWER(process.executable) LIKE "*.zip.*" OR TO_LOWER(process.executable) LIKE "*.mp3.*" OR TO_LOWER(process.executable) LIKE "*.mp4.*") AND (TO_LOWER(process.executable) LIKE "*.exe" OR TO_LOWER(process.executable) LIKE "*.scr" OR TO_LOWER(process.executable) LIKE "*.hta" OR TO_LOWER(process.executable) LIKE "*.lnk" OR TO_LOWER(process.executable) LIKE "*.bat" OR TO_LOWER(process.executable) LIKE "*.cmd" OR TO_LOWER(process.executable) LIKE "*.vbs" OR TO_LOWER(process.executable) LIKE "*.js" OR TO_LOWER(process.executable) LIKE "*.jar" OR TO_LOWER(process.executable) LIKE "*.msi" OR TO_LOWER(process.executable) LIKE "*.ps1"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\.txt\.|\.jpg\.|\.jpeg\.|\.png\.|\.gif\.|\.pdf\.|\.doc\.|\.docx\.|\.xls\.|\.xlsx\.|\.ppt\.|\.pptx\.|\.csv\.|\.zip\.|\.mp3\.|\.mp4\.)</field>    <field name="Image" type="pcre2">(?i)(\.exe$|\.scr$|\.hta$|\.lnk$|\.bat$|\.cmd$|\.vbs$|\.js$|\.jar$|\.msi$|\.ps1$)</field>    <description>Executable run from a file name carrying a benign extension before it</description>    <mitre>      <id>T1036.007</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: masquerading
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: f32a56da-31db-471e-8ca8-5ada99a60486

ATT&CKT1036.007

T1036.007Double File Extension

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1036.007, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

level: medium reflects that the loudest false positive — SFX installers naming their payload descriptively — is a real, recurring pattern in consumer and trade-show software, not a rare edge case, so high would overstate confidence. If deploying, first check whether your sandbox or EDR tooling uses this exact rename pattern internally; if so, add its wrapper path to an allowlist before enabling. Consider narrowing the extended extension lists back toward MITRE's four-and-four before trusting hit volume, since the pipeline's additions are unverified guesses at scope.

Declared by the author

Self-extracting archive installers and vendor demo or kiosk bundles that describe their payload in the file name ahead of the .exe wrapper, e.g. Catalog.pdf.exe or Presentation.pptx.exe — a naming convention some trade-show and marketing software vendors use deliberately for descriptive SFX installers.
Email-security and sandbox or detonation tooling that renames a quarantined attachment by appending its original extension in front of the tool's own wrapper extension, such as invoice.pdf.exe, before re-executing the wrapper inside an isolated analysis chamber.
Backup, versioning or migration tools that stage a renamed copy of an executable payload with a descriptive extension chain, for example when a packaging step writes install.msi.exe as an intermediate artefact and then runs it directly.

Lessonmasquerading

masqueradingAI draft — unreviewed

01 · What this rule detects

MITRE's AN1033 describes a double-extension trick: a file whose visible extension looks benign (.txt, .jpg, .pdf) but whose real, trailing extension is dangerous (.exe, .scr) — e.g. Invoice_Q3.pdf.scr — is then executed. This rule authors only the execution half of that chain, on Sysmon process creation: it fires when a process image path carries a benign-looking extension immediately followed by another dot and a dangerous one.

02 · Telemetry you need

Sysmon Event ID 1 (ProcessCreate). This is not enabled by default and needs a ProcessCreate rule configured in the Sysmon config; without it the rule returns nothing, which reads as quiet rather than as blind telemetry.

03 · How the logic works

condition: selection_benign_marker and selection_dangerous requires both selections to match the same Image field. selection_benign_marker checks that Image contains one of a list of benign-extension substrings each followed by a literal dot (.txt., .jpg., .pdf., and so on). selection_dangerous checks that Image ends with one of a list of dangerous extensions (.exe, .scr, and so on). Together they require the double-extension shape MITRE names: a benign-looking extension sitting directly in front of the real one. Only four extensions per list come from MITRE's benign_extensions and dangerous_extensions knobs in the brief: benign .txt, .jpg, .doc, .pdf; dangerous .exe, .scr, .hta, .lnk. Everything else in the rule — twelve further benign extensions (.jpeg, .png, .gif, .docx, .xls, .xlsx, .ppt, .pptx, .csv, .zip, .mp3, .mp4) and seven further dangerous ones (.bat, .cmd, .vbs, .js, .jar, .msi, .ps1) — is this pipeline's own extrapolation, not something MITRE specified. Treat the extended lists as a plausible starting point, not a sourced fact. Two things the rule deliberately skips. It does not use the Sysmon Event ID 11 file-creation leg the analytic also offers, because a file-creation event alone cannot distinguish a double-extension drop from any other file write — the signal only becomes distinct at execution, which is where this rule sits. It also does not gate on MITRE's monitored_paths knob (Downloads, %TEMP%, Desktop) or apply the TimeWindow/UserContext knobs at all: narrowing to those paths would miss a payload run from elsewhere, and lib/sigma has no timeframe or aggregation support to correlate a create-then-execute sequence. The result is a path-agnostic rule that depends entirely on the double-extension shape of the name, wherever it runs.

04 · Common false positives

Three named sources. Self-extracting archive installers and vendor demo or kiosk bundles sometimes describe their payload in the filename ahead of the .exe wrapper, e.g. Catalog.pdf.exe, as a deliberate naming convention. Email-security and sandbox/detonation tooling can rename a quarantined attachment by appending its original extension in front of the tool's own wrapper extension (invoice.pdf.exe) before re-executing it in an isolated chamber. Backup, versioning, or migration tools can stage a renamed copy of an executable with a descriptive extension chain, such as an intermediate install.msi.exe artefact that then gets run directly.

05 · Detection maturity

tier_1: This rule sits at the lowest DeBMM tier: authored from MITRE's analytic prose, never run against real log data, and unverified. It should be treated as a starting scaffold to validate against actual Sysmon output — particularly to measure how often the extended extension lists fire on legitimate software — before any operational trust is placed in it.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/f32a56da-31db-471e-8ca8-5ada99a60486

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Executable run from a file name carrying a benign extension before it

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it