Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
16
8
2
2
1
Contributors
8
6
4
3
2
Categories
14
7
5
4
4
Platforms
26
3
Products / Services
15
3
3
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.
Detects the execution of VBScript files that use a double extension (.pdf.vbs) via Windows Script Host (wscript.exe or cscript.exe). This technique is commonly used to masquerade malicious scripts as benign PDF documents to deceive users into executing them.
Detects the execution of a .pif (Program Information File) process where the filename contains keywords suggestive of image files (e.g., 'image', 'photo', 'scan'). Adversaries often use this technique to trick users into executing malicious code by masquerading the file type.
Detects the execution of LNK files masquerading as PDF files through the use of double extensions (e.g., .pdf.lnk). The rule monitors for processes spawned by explorer.exe that contain '.pdf.lnk' in the command line and trigger child processes like PowerShell, CMD, WScript, or MSHTA, which are common indicators of malicious intent.
This rule detects the execution of script files (such as .vbs, .vbe, .js, .jse) via wscript.exe when the file name uses a double-extension technique (e.g., .pdf.vbs) to masquerade as a benign PDF document. These files are typically found in temporary or user-download directories, indicating potential malicious activity initiated by downloaded attachments.
Detects the potential creation or execution of malicious JavaScript files that masquerade as PDF or other common documents using double extensions (e.g., .pdf.js). This behavior is often associated with file-based loaders where the operating system masks the true file extension. The rule also triggers when these files are explicitly launched via Windows Script Host (wscript.exe or cscript.exe).
Detects the execution of LNK files that use a double extension (e.g., .pdf.lnk) to masquerade as PDF documents. This behavior is indicative of spear-phishing campaigns where malicious shortcuts are delivered via ZIP archives to execute hidden PowerShell commands for secondary stage downloader or persistence mechanisms.
This rule detects the use of double extensions in file names to masquerade executable files as benign document or media file types (e.g., 'document.pdf.exe'). This is a common technique used by attackers to trick users into executing malicious files by hiding their true extension.
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Detects the execution of files attempting to spoof benign document types via double extensions, specifically when initiated by explorer.exe. This technique is often used in phishing attacks to trick users into executing malicious files that appear to be safe documents.
Identifies the execution of files with classic double extensions designed to trick users into clicking what they think is a document. This rule specifically looks for filenames ending with common document/image extensions followed by executable extensions.
Detects files executing with double extensions designed to trick users (e.g., .pdf.exe). This rule specifically looks for process events where the filename matches a pattern of a common document/image/archive extension followed by an executable extension.
This rule detects HTTP responses that contain a URI with a double extension, where the first extension is a common document or image file type (doc, pdf, jpg, png, txt) and the second extension is an executable or script file type (exe, bat, vbs, ps1, cmd). This pattern is often used in file masquerading to trick users into executing malicious files.
This rule detects email attachments that use a double extension, specifically looking for files that appear to be common document or image types (doc, pdf, jpg) but have a hidden executable extension (exe, bat, vbs). This technique is often used by attackers to trick users into opening malicious files.
Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.
Detect execution of suspicious double extension files in ParentCommandLine
Detects the download of a file with a double extension (e.g., invoice.pdf.exe). This is a common technique used to disguise malicious files and trick users into executing them.
Detects the use of certutil.exe to decode a payload from a file with a misleading extension (e.g., .png) and save it as a DLL in a suspicious location. This technique was observed in the 'Operation Hanoi Thief' campaign.
Detects the creation of files with double extensions, a common technique used by malware to masquerade as benign files, especially when Windows is configured to hide known file extensions. This rule specifically looks for files ending with common executable or archive extensions (like .exe, .iso, .rar, .zip, .svg) preceded by another common file extension (like .doc, .pdf, .jpg, .png, etc.).
Page 1 of 2