BIOC
Medium
✕
Process runs with a double extension
Look for executables with a common double extension. These are often used to disguise malware as some form of user content.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- File Type Obfuscation
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: User Execution (T1204)
Indicator:
Process action type = execution AND target process name = *.docx.exe , *.xlsx.exe , *.pptx.exe , *.pdf.exe , *.wav.exe , *.mp3.exe , *.mkv.exe , *.avi.exe , *.mp4.exe , *.gif.exe , *.bmp.exe , *.png.exe , *.jpg.exe , *.jpeg.exe , *.m4a.exe , *.html.exe , *.htm.exe , *.mht.exe , *.doc.exe , *.xls.exe , *.ppt.exe Process cgo name != NewWorld.Services.MobileServer.exe
Preventable: yes