Double Extension Execution Profiling

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•4

Detects the execution of files attempting to spoof benign document types via double extensions, specifically when initiated by explorer.exe. This technique is often used in phishing attacks to trick users into executing malicious files that appear to be safe documents.