Execution of PDF-Masquerading .lnk File via Double Extension

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•6

Detects the execution of LNK files masquerading as PDF files through the use of double extensions (e.g., .pdf.lnk). The rule monitors for processes spawned by explorer.exe that contain '.pdf.lnk' in the command line and trigger child processes like PowerShell, CMD, WScript, or MSHTA, which are common indicators of malicious intent.