Evasion via File Name Masquerading

[rule]
description = """
Adversaries may abuse a double extension or unicode right-to-left override (RTLO or RLO) character (U+202E) or multiple
spaces in the filename as a means of masquerading the true file type. A file name may include a secondary file type
extension that may cause only the first extension to be displayed which maximize user execution likelihood.
"""
id = "ccfca0c7-c975-4735-82bd-954ffbafd00b"
license = "Elastic License v2"
name = "Evasion via File Name Masquerading"
os_list = ["windows"]
reference = ["https://www.pcmag.com/encyclopedia/term/double-extension"]
version = "1.0.31"

query = '''
process where event.action == "start" and
 (
  /* double extension in process.name */
  process.name regex~ """.+(\.|\,|\_|\-)(pdf|doc|docx|xls|xlsx|png|jpg|html|txt|rar|ppt|pptx|htm|GIF)\.(scr|exe|com|pif)""" or

  process.name : ("*   pdf.exe", "*_pdf.exe", "*_PO_N.*PDF.exe") or

  /* multiple spaces */
  process.name regex """.+\s{10,}\.(exe|pif|com|scr)""" or
  process.name : "*                    .exe" or 

  /* fake extension via Unicode Right-To-Left-Override technique */
  process.name : "*\u{202E}*"
 ) and

 /* False Positives */
 not process.hash.sha256 : 
             ("1211cb4a560586d4ffb4b1bfd268a8146318af09587a9d5e33703575d5178e77", 
              "582ae3540ba32e7100fe20c0b01d14d1d85167cdb7ee512f596544d7351a2d5e", 
              "b59ac9390d9026ec3b552ebd6f3438c05aab2880d5e17616c13c5d42b6b34c65",
              "a781c337575da892e6c1b2ac26a6272085a127c554dfd68729deb146eca6b837",
              "96234bb98b3266e49ef74ac7accd4644b709355057d5a34b2966e9fa56aadcf3",
              "38473e19af02cb5e6f386f41238da862df72bbc1d7a1e94d838c4b93d6f56e72",
              "5d62d79f6555d7a7edaf3b175312b326df779f9ae8c893e2182e4159f44c9d34",
              "8d0434610280c8f94a0e9c29e4c33b97804fab4ab6fc29531ba76acebd2f5518",
              "7e59dec861a2a9ad68bd2758407c256dedb233cab225683db677ab2d2fbec258",
              "fbd43f9a3567a19427894e61052d1b46f70b7474357ef50de9dc8749fc950509",
              "96234bb98b3266e49ef74ac7accd4644b709355057d5a34b2966e9fa56aadcf3",
              "0ec0ebc7c71ee139ee29fca1e2447b5cc5ec79cb797deb8b560cb05fee3ca3a6",
              "f4e3e2798fe830eac6990d83f568f6cfbba3a194a7787fe224aa1ba90976eaa7",
              "3abbe0ab12a1baa4c0492c5dba9901f3176f23d35998e8f9a1f753880617523c",
              "13fda552b026d0ecba34fbb488a57dbd29187ebef012874eda115ba5c876dade",
              "3e562ff6f8616c623c82b25a6ab2fff7b2832ec2c53ce5c242d047a525f563ff",
              "d0d177839db17d9f30aebe61594dde7e9e8ab82473f3947892cc88ad58939669") and
 not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and process.code_signature.trusted == true) and
 not (process.code_signature.subject_name : ("AVANQUEST SOFTWARE S.A.S", "Jernej Simončič") and process.code_signature.trusted == true) and 
 not process.executable :
             ("?:\\Program Files (x86)\\PlotSoft\\PDFill_PDF_Tools\\PlotSoft_PDF.exe",
              "?:\\Program Files\\Ab Initio\\Ab Initio GDE 4.1.4.0\\Program Files\\ab_zip.exe",
              "C:\\Program Files\\GIMP 3\\lib\\gimp\\3.0\\plug-ins\\file-png\\file-png.exe",
              "C:\\Users\\*\\AppData\\Local\\Programs\\GIMP 3\\lib\\gimp\\3.0\\plug-ins\\file-png\\file-png.exe",
              "\\Device\\Mup\\*\\file-png.exe") and
 not process.parent.executable : ("C:\\Program Files (x86)\\Visionet Systems Inc\\Visionet.DocVu.KofaxExtractionService\\Visionet.DocVu.KofaxExtractionService.exe",
                                  "C:\\Program Files (x86)\\Visionet System Inc\\DocVuOcrService-NPF\\Visionet.DocVu.OCRService.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.002"
name = "Right-to-Left Override"
reference = "https://attack.mitre.org/techniques/T1036/002/"

[[threat.technique.subtechnique]]
id = "T1036.007"
name = "Double File Extension"
reference = "https://attack.mitre.org/techniques/T1036/007/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"