Process Execution with Double Extensions

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Identifies the execution of files with classic double extensions designed to trick users into clicking what they think is a document. This rule specifically looks for filenames ending with common document/image extensions followed by executable extensions.