Techniques › T1036.007 › AN1033
AN1033 Analytic 1033
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversary behavior where a file with a benign-looking first extension (e.g., .txt, .jpg) ends with a dangerous second extension (e.g., .exe, .scr), and is subsequently executed. The behavior chain includes file creation with misleading naming and user or system-initiated process execution from the disguised file.</p>
- Detects
- T1036.007 Double File Extension
- Part of
- DET0366 Detection Strategy for Double File Extension Masquerading
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
benign_extensions | List of extensions typically used to masquerade malicious files (.txt, .jpg, .doc, .pdf) |
dangerous_extensions | List of true executable extensions that may be abused (.exe, .scr, .hta, .lnk) |
monitored_paths | Specific directories to focus on (e.g., Downloads folder, %TEMP%, Desktop) |
TimeWindow | Duration between file creation and process execution to correlate activity |
UserContext | Whether the behavior occurs in a standard user session or elevated context |