Potential Executable Masquerading as Document - Windows (Sysmon)

id: '21579.38122'
title: Potential Executable Masquerading as Document - Windows
description: 'Adversaries may abuse double extensions to attempt to conceal dangerous
  file types of payloads. This use case detects executions of files that appear to
  be document or image files but execute as script or executable files, or executable/script
  files with 3 or more spaces or underscores preceding the extension in an effort
  to obscure the file''s actual extension. CVE-2023-38831 -- Threat Actor Association:
  APT28, APT40, Sandworm Team, UAC-0057 (GhostWriter)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (".pdf" OR ".jpg" OR ".jpeg" OR "gif" OR ".ico" OR ".doc" OR ".xls" OR ".docx" OR
  ".xlsx" OR ".png" OR ".xml" OR ".csv" OR ".ppt" OR ".pptx" OR ".rtf" OR ".txt")
  (".cmd" OR ".bat" OR ".ps1" OR ".vbs" OR ".js" OR ".py" OR ".exe" OR ".msi" OR ".vbe"
  OR ".lnk" OR ".scr") | regex process="(?i)((\s{3,}|_{3,})|(\.(pdf|jpg|jpeg|gif|ico|doc|xls|docx|xlsx|png|xml|csv|ppt|pptx|rtf|txt)(\s+)?))\.(cmd|bat|ps1|vbs|js|py|exe|msi|vbe|lnk|scr)"
  | table _time, host, user, process, process_*, parent_process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading:double file extension
technique_id:
- T1036.007
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
- https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/