Double File Extension is ATT&CK T1036.007. It is a Stealth technique and, per MITRE, it applies to Windows. A file name carries a second extension that decides how the file really opens, while the first extension is the one a person sees.
How attackers use it
MITRE explains that a name like File.txt.exe may render in some views as just File.txt. The real extension is the second one, and it determines how the file is opened and executed. The operating system can hide the real extension in the file browser, explorer.exe included, and in any software that follows the same policy.
The typical path starts with a spearphishing attachment. An executable named Evil.txt.exe shows as Evil.txt, the user treats it as a text file and opens it, and the hidden program runs. MITRE notes that text and document types and image types are common first extensions, while the dangerous extensions that tend to sit second are .exe, .lnk, .hta and .scr.
Procedure examples on the page include a loader that used dual-extension files such as PreviewReport.DOC.exe, malicious LNK files disguised as PDFs with the extension .pdf.lnk, and an executable named companycatalog.exe.config.
How to detect it
The MITRE analytic describes a chain: a file is created with a benign-looking first extension and a dangerous second extension, then the file is executed, either by a user or by the system. So you want two data sources together:
- File creation events, to catch names that end in a dangerous extension after a document or image extension.
- Process creation events, to see whether the file then ran.
A simple pattern for a hunt is a name that matches a document or image extension followed immediately by .exe, .scr, .lnk or .hta. Mail gateways can apply the same pattern to attachment names before delivery.
How to reduce the risk
MITRE lists two mitigations:
- Operating system configuration. Disable the default that hides file extensions for known file types in Windows. With extensions visible, the second extension is the one that stays on screen.
- User training. Teach people to look for double extensions and to be suspicious of unexpected attachments in general.
Check your own environment
Windows, check whether file extensions are hidden for the current user. A value of 1 means they are hidden, 0 means shown:
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name HideFileExt
Windows PowerShell, search a folder for names with a document or image extension followed by an executable one:
Get-ChildItem C:\Users -Recurse -File -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match '\.(txt|doc|docx|pdf|jpg|png|xls|xlsx)\.(exe|scr|lnk|hta)$' }
Group Policy or your endpoint management tool is the right place to apply the extension setting for the whole estate.
Quick check
Which extension decides how a file with two extensions opens?
The last one. In Evil.txt.exe the real type is .exe, even though some views show only Evil.txt.
Which MITRE mitigation removes most of the visual trick?
Disabling the Windows default that hides file extensions for known file types.
