BIOC Medium

Process runs with a double extension

Look for executables with a common double extension. These are often used to disguise malware as some form of user content.

Module:
Platform Analytics
Agent event type:
Process execution
Category:
File Type Obfuscation
Status:
Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: User Execution (T1204)
Indicator:

Process action type = execution AND target process name = *.docx.exe , *.xlsx.exe , *.pptx.exe , *.pdf.exe , *.wav.exe , *.mp3.exe , *.mkv.exe , *.avi.exe , *.mp4.exe , *.gif.exe , *.bmp.exe , *.png.exe , *.jpg.exe , *.jpeg.exe , *.m4a.exe , *.html.exe , *.htm.exe , *.mht.exe , *.doc.exe , *.xls.exe , *.ppt.exe Process cgo name != NewWorld.Services.MobileServer.exe

Preventable: yes