Double Extension Masquerading - Executable Disguised as Document or Media

Montaser Ismail@M0nt3x

•updated Aug 6, 2026•4•0•8

Double extension masquerading is a defense-evasion technique (cataloged under MITRE ATT&CK T1036.007) where a malicious executable file is disguised with a safe-sounding first extension, such as .pdf.exe or .jpg.scr , etc, to trick users into opening it. This rule is used to detect suspicious double Extension Masquerading