Double Extension Execution
Detects files executing with double extensions designed to trick users (e.g., .pdf.exe). This rule specifically looks for process events where the filename matches a pattern of a common document/image/archive extension followed by an executable extension.
Microsoft Sentinel (KQL)
