Detection of Suspicious PIF File Creation, Execution, and Persistence
This detection scenario focuses on the abuse of legacy .pif (Program Information File) extensions for malware delivery, execution, and persistence on Windows endpoints. Attackers may use .pif files, sometimes with deceptive double extensions or in user-writable folders, to execute arbitrary code, evade user scrutiny, or persist via the registry, exploiting the fact that .pif files are still natively executable on modern Windows systems. Algorithm: - Monitor for .pif file creation in user-writable folders (excluding well-known dev/test tools/processes and paths). - Detect execution of any .pif file in user-writable folders. - Detect suspicious child process launch (e.g., scripting engines or LOLBins) from a .pif parent process. - Detect registry persistence attempts (Run/RunOnce) by .pif processes. - Suppress false positives by excluding known dev/test folders and processes.
Microsoft Sentinel (KQL)
