Suspicious Parent Double Extension File Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the execution of suspicious files that use a double extension in their name, specifically when these files appear in the ParentImage or ParentCommandLine. This technique is often used by adversaries to masquerade malicious executables as benign document or script files, tricking users into executing them.