Suspicious Double Extension File Execution

SigmaHQ Detections@sigmaHQ

•updated Jun 5, 2025•1•0•20

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, or a set of spaces or underlines to cloak the executable file, often used in spear phishing campaigns to trick users into executing malicious files.