Suspicious File Extension Renaming

Ankit Mehta@Secvyn

•updated Jun 17, 2026•1•0•2

Detects files with suspicious double extensions (e.g., .exe.txt, .dll.txt) or .scr extension, which can indicate an attempt to masquerade malicious executables or scripts as benign text files or screensavers. The rule excludes files in the System32 directory to reduce false positives.