Mustang PandaG0129 ↗
Has used an additional filename extension to hide the true file type.12
- Tactic
- Stealth
- Platform
- Windows
- Version
- 2.0
- Created
- 04 August 2021
- Last modified
- 12 May 2026
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.[1][2]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.3
Detection rules54th pct
Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.Double File Extension MITRE reference T1036.007
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
KimsukyG0094 ↗
Has used an additional filename extension to hide the true file type. Kimsuky has also masqueraded malicious LNK files as PDF objects using the double extension .pdf.lnk.1
All 2 groups for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
DarkGateS1111 ↗
Masquerades malicious LNK files as PDF objects using the double extension .pdf.lnk.1
MilanS1015 ↗
Has used an executable named companycatalog.exe.config to appear benign.1
BazarS0534 ↗
The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.1
All 3 software entries for this technique
Offense vs defense T1036.007
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 0
first rule: 2022 Q2Double File Extension detection strategy DET0366
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Double File Extension Masquerading
1 platform
AN1033 · Windows
Detects adversary behavior where a file with a benign-looking first extension (e.g., .txt, .jpg) ends with a dangerous second extension (e.g., .exe, .scr), and is subsequently executed. The behavior chain includes file creation with misleading naming and user or system-initiated process execution from the disguised file.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| benign_extensions | List of extensions typically used to masquerade malicious files (.txt, .jpg, .doc, .pdf) |
| dangerous_extensions | List of true executable extensions that may be abused (.exe, .scr, .hta, .lnk) |
| monitored_paths | Specific directories to focus on (e.g., Downloads folder, %TEMP%, Desktop) |
| TimeWindow | Duration between file creation and process execution to correlate activity |
| UserContext | Whether the behavior occurs in a standard user session or elevated context |
Disable the default to “hide file extensions for known file types” in Windows OS.
User TrainingM1017
Train users to look for double extensions in filenames, and in general use training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.
Tests2Executorscmd 1 · sh 1Need elevation0 of 2Have prerequisites1Have cleanup2Platformswindows, linux
Tests from Atomic Red Team (MIT licence) · technique definition