Double Extension File Masquerading as Document

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects HTTP responses that contain a URI with a double extension, where the first extension is a common document or image file type (doc, pdf, jpg, png, txt) and the second extension is an executable or script file type (exe, bat, vbs, ps1, cmd). This pattern is often used in file masquerading to trick users into executing malicious files.