TA0005 · DEFENSE EVASION
Double File Extension
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.
Detect it with
Monitor for files written to disk that contain two file extensions, particularly when the second is an executable.
Why it matters on shift
Double File Extension is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context