technique: Double extension

category: Social Engineering

detected_by: AV heuristic


category: Malware Delivery

detected_by: File signature


detected_by: Sandbox analysis


technique: Right-to-left override

detected_by: Unicode inspection


technique: Unicode homoglyph

category: Evasion


filename: report .exe

technique: Whitespace padding


technique: Mimic legitimate extension


filename: file.pdf   .exe


technique: Mimic system file


technique: Reverse double extension


filename: doc .pdf.exe


technique: Generic extension

detected_by: Content analysis


filename: data .doc.exe


technique: Mimic system process


technique: Dot padding


technique: Alternate data stream

detected_by: ADS inspection


technique: Icon spoofing


technique: Triple extension


technique: Environment variable path

category: Persistence

detected_by: Behavioral analysis


technique: Compressed file mimicry


technique: Script obfuscation

detected_by: Entropy analysis


technique: Control panel extension


technique: Double extension


technique: Unicode circled letters


technique: Multiple dot padding


technique: Mimic system DLL


technique: Right-to-left override


technique: Unicode gothic letters


technique: Shortcut masquerade


technique: Nested compression mimicry


filename: file.doc    .exe

technique: Trailing whitespace


technique: Mimic system process


technique: Alternate data stream


technique: Reverse extension trick


technique: Unicode bold letters


technique: Unicode square letters


technique: Compressed file mimicry


technique: Script obfuscation


technique: Unicode serif bold


technique: Double extension


technique: Unicode monospace


technique: Base64 encoding


technique: Dot padding


technique: Right-to-left override


technique: Unicode full-width


technique: Multiple dot padding


technique: Shortcut masquerade


technique: Unicode small letters


technique: Invisible Unicode separator


technique: WebAssembly mimicry


technique: NTFS attribute manipulation


technique: Unicode emoji homoglyph


technique: QUIC protocol extension

category: Data Exfiltration

detected_by: Network analysis


technique: Polymorphic extension cycling


technique: Linux device file mimicry


technique: Windows AppX spoofing


technique: Invisible Unicode joiner


technique: Alternate data stream


technique: Unicode monospace homoglyph


technique: Unicode left-to-right mark


technique: IPFS file mimicry


technique: Quantum-resistant encoding


technique: NTFS reserved name


technique: Nested shortcut extension


technique: Emoji-based extension


technique: Steganography in ADS

detected_by: Steganalysis


technique: Unicode BOM marker


technique: Linux snap package mimicry


technique: Unicode bold serif homoglyph


technique: Web media mimicry


technique: ML model embedding

detected_by: Memory forensics


technique: Torrent file mimicry


technique: Unicode zero-width joiner


technique: Linux flatpak mimicry


technique: Script obfuscation in ADS


technique: Unicode square emoji homoglyph


technique: Arweave blockchain mimicry


technique: Polymorphic extension cycling


technique: Unicode narrow no-break space


technique: Linux AppImage mimicry


technique: Unicode monospace bold homoglyph


technique: HLS streaming mimicry


technique: ML model embedding in ADS


technique: Decentralized web mimicry


technique: NTFS reserved name


technique: Unicode word joiner


technique: Windows UWP app spoofing


technique: QR code encoding in ADS


technique: Unicode italic homoglyph


technique: DASH streaming mimicry


technique: Unicode zero-width non-joiner


technique: Container image mimicry


technique: Unicode circled emoji homoglyph


technique: IPNS file mimicry


technique: Quantum-resistant encoding in ADS


technique: Unicode invisible plus


technique: Windows MSIX app spoofing


technique: Script obfuscation in ADS


technique: Unicode serif monospace homoglyph


technique: Web3 storage mimicry


technique: Polymorphic extension cycling


technique: Unicode medium mathematical space


technique: OCI container mimicry


technique: Unicode bold italic homoglyph


technique: M3U8 playlist mimicry


technique: Steganography in ADS


technique: Unicode function application


technique: Podman container mimicry


technique: Unicode boxed emoji homoglyph


technique: Sia blockchain mimicry


technique: Unicode invisible times


technique: Kubernetes manifest mimicry


technique: ML model embedding in ADS


technique: Unicode sans-serif homoglyph


technique: Storj storage mimicry


technique: Double extension disguise

detected_by: Signature-based detection


technique: Script disguised as document

detected_by: Heuristic analysis


technique: Image file with executable extension


technique: Compressed archive with executable suffix

detected_by: Sandboxing


technique: Alternate data stream hiding

detected_by: File system monitoring


technique: Archive with executable extension


technique: Image file masquerading


technique: Hidden file extension using NTFS streams


technique: Zone identifier ADS to bypass security


technique: JavaScript file disguised as executable


technique: Alternate data stream with null byte


technique: Audio file with executable extension


technique: Video file disguised as script


technique: Batch script disguised as presentation


technique: Hidden extension using NTFS streams


technique: Installer file with executable suffix


technique: Alternate data stream with malicious payload


technique: Text file with executable extension


technique: Config file disguised as script


technique: Batch script disguised as data file


technique: Alternate data stream with malicious code


technique: Bitmap image with executable extension


technique: VBScript disguised as executable


technique: PDF file with executable extension


technique: AVI video disguised as script


technique: Batch script disguised as audio file


technique: Alternate data stream with executable payload


technique: GIF image with executable extension


technique: PowerShell script disguised as executable


technique: Word document with executable extension


technique: Batch script disguised as archive


technique: Markdown file with executable extension


technique: XML config disguised as script


technique: Batch script disguised as JSON data


technique: RTF file with executable extension


technique: MSI installer disguised as script


technique: Batch script disguised as TIFF image


technique: Log file with executable extension


technique: Shell script disguised as executable


technique: Batch script disguised as OpenDocument text


technique: Double extension disguise


technique: Script disguised as document


technique: Image file with executable extension


technique: Compressed archive with executable suffix


technique: Alternate data stream hiding


technique: Archive with executable extension


technique: Image file masquerading


technique: Hidden file extension using NTFS streams


technique: Zone identifier ADS to bypass security


technique: JavaScript file disguised as executable


technique: Alternate data stream with null byte


technique: Audio file with executable extension


technique: Video file disguised as script


technique: Batch script disguised as presentation


technique: Hidden extension using NTFS streams


technique: Installer file with executable suffix


technique: Alternate data stream with malicious payload


technique: Text file with executable extension


technique: Config file disguised as script


technique: Batch script disguised as data file


technique: Alternate data stream with malicious code


technique: Bitmap image with executable extension


technique: VBScript disguised as executable


technique: PDF file with executable extension


technique: AVI video disguised as script


technique: Batch script disguised as audio file


technique: Alternate data stream with executable payload


technique: GIF image with executable extension


technique: PowerShell script disguised as executable


technique: Word document with executable extension


technique: Batch script disguised as archive


technique: Markdown file with executable extension


technique: XML config disguised as script


technique: Batch script disguised as JSON data


technique: RTF file with executable extension


technique: MSI installer disguised as script


technique: Batch script disguised as TIFF image


technique: Log file with executable extension


technique: Shell script disguised as executable


technique: Batch script disguised as OpenDocument text


technique: Encrypted alternate data stream


technique: Payload hidden in ADS


technique: Steganography in alternate data stream

detected_by: Advanced forensic analysis


technique: Macro hidden in ADS


technique: Command shell payload in ADS


technique: Malicious code in ADS


technique: Config file with hidden payload


technique: Exploit code in ADS


technique: Malware hidden in ADS


technique: Trojan code in ADS


technique: Installer with hidden payload


technique: Polymorphic extension cycling


technique: Encrypted payload in ADS