name: Execution of File with Multiple Extensions
id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7
version: 3
date: '2020-11-18'
author: Rico Valdez, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for processes launched from files that have double
  extensions in the file name. This is typically done to obscure the "real" file extension
  and make it appear as though the file being accessed is a data file, as opposed
  to executable content.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe
  OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process
  = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by
  Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
  in the processes node.
known_false_positives: None identified.
references: []
tags:
  analytic_story:
  - Windows File Extension and Association Abuse
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 3
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1036.003
  nist:
  - DE.CM
  - PR.PT
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.dest
  - Processes.user
  - Processes.parent_process
  security_domain: endpoint
