User Execution - Double Extension File Download
This rule detects the download of files that have a 'double extension' pattern, specifically where a common document or image file extension (pdf, doc, jpg, png) is followed by an executable extension (exe, bat, vbs, ps1). This pattern is often used by attackers to trick users into executing malicious files, as the operating system might only display the first extension, making the file appear benign. The detection is based on analyzing the HTTP URI for this specific naming convention.
Suricata
