T1036.007 — Double File Extension

Tactic: Stealth · Platforms: Windows

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt). However, the second…

Sub-technique of Masquerading (T1036).

Sigma detection rules (1)

T1036.007 Masquerading: Double File Extension

title: "T1036.007 Masquerading: Double File Extension"
id: cf80b9cb-385a-4198-8fdc-9dc80e13325e
description: 'Detection Strategy for Double File Extension Masquerading. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: benign_extensions, dangerous_extensions, monitored_paths, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1036/007
author: Shahrukh Khan
date: 2026-05-31
license: MIT
tags:
  - attack.stealth
  - attack.t1036.007

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|re: '(?i)\.(txt|pdf|doc|docx|xls|xlsx|ppt|pptx|jpg|jpeg|png|gif|mp3|mp4|zip|rar|csv)\.(exe|scr|com|pif|bat|cmd|vbs|vbe|js|jse|wsf|wsh|hta|ps1|msi|lnk)
    
  



  condition: selection

falsepositives:
  - Legitimate filenames intentionally containing multiple periods before a genuine executable extension (rare).

level: medium

Related sub-techniques

Explore