Process started from an image with a document or image extension

Siemphony@siemphonyhighT1036.008unverified

AN0630 asks for files carrying a harmless extension that are nonetheless executed as binaries. Windows loads a portable executable by its header and not by its name, so a payload saved as invoice.pdf or logo.jpg runs perfectly well when something calls CreateProcess on it — and when it does, Sysmon EventID 1 records that full path in Image. This rule is exactly that single observation: a process whose own image file ends in an extension that is never used for executable content. The extension list is authored here from MITRE's benign_extensions knob, populated with the document and image types the technique description names. What it cannot see is worth stating plainly. The magic-byte comparison the analytic centres on (MITRE's MagicByteMismatchThreshold knob) has no carrier at all — neither Sysmon EventID 1 nor EventID 11 records file headers — so this rule infers the masquerade from the extension alone and would equally miss a payload named with no extension. It also misses the two most common execution paths for a masqueraded file: renaming it back to .exe before running it, and handing it to a loader such as rundll32.exe, where Image is the loader and the masqueraded name appears only inside CommandLine, mixed in with every benign command line that mentions a document. Prerequisite: Sysmon is not present in a default install, and its ProcessCreate section must not be filtered to a binary allowlist, or this rule returns zero rows — which reads as quiet when it means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0226, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith ".jpg" or FolderPath endswith ".jpeg" or FolderPath endswith ".png" or FolderPath endswith ".gif" or FolderPath endswith ".bmp" or FolderPath endswith ".txt" or FolderPath endswith ".log" or FolderPath endswith ".pdf" or FolderPath endswith ".rtf" or FolderPath endswith ".doc" or FolderPath endswith ".docx" or FolderPath endswith ".xls" or FolderPath endswith ".xlsx" or FolderPath endswith ".csv")

Splunk · SPL

Run this as a search.

index=* (Image="*.jpg" OR Image="*.jpeg" OR Image="*.png" OR Image="*.gif" OR Image="*.bmp" OR Image="*.txt" OR Image="*.log" OR Image="*.pdf" OR Image="*.rtf" OR Image="*.doc" OR Image="*.docx" OR Image="*.xls" OR Image="*.xlsx" OR Image="*.csv")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*.jpg" OR TO_LOWER(process.executable) LIKE "*.jpeg" OR TO_LOWER(process.executable) LIKE "*.png" OR TO_LOWER(process.executable) LIKE "*.gif" OR TO_LOWER(process.executable) LIKE "*.bmp" OR TO_LOWER(process.executable) LIKE "*.txt" OR TO_LOWER(process.executable) LIKE "*.log" OR TO_LOWER(process.executable) LIKE "*.pdf" OR TO_LOWER(process.executable) LIKE "*.rtf" OR TO_LOWER(process.executable) LIKE "*.doc" OR TO_LOWER(process.executable) LIKE "*.docx" OR TO_LOWER(process.executable) LIKE "*.xls" OR TO_LOWER(process.executable) LIKE "*.xlsx" OR TO_LOWER(process.executable) LIKE "*.csv")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\.jpg$|\.jpeg$|\.png$|\.gif$|\.bmp$|\.txt$|\.log$|\.pdf$|\.rtf$|\.doc$|\.docx$|\.xls$|\.xlsx$|\.csv$)</field>    <description>Process started from an image with a document or image extension</description>    <mitre>      <id>T1036.008</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: masquerading
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 4e660768-0c35-4349-afb6-ad04b36be85c

ATT&CKT1036.008

T1036.008Masquerade File Type

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonmasquerading

masqueradingAI draft — unreviewed

01 · What this rule detects

The rule makes one narrow observation: a Windows process whose own image file ends in an extension that is never used for executable content. Windows loads a portable executable by its header, not by its name, so a payload saved as invoice.pdf runs perfectly well once something calls CreateProcess on it — and Sysmon EventID 1 records that full path in Image. MITRE's AN0630 is a two-part analytic: a file created with a misleading extension, correlated with a later execution, plus a magic-byte mismatch. Only the execution half was written. No log source in the brief records file headers, and lib/sigma has no correlation construct, so the masquerade here is inferred from the extension alone. The rule covers materially less than the analytic it cites, and that is the honest starting point for reading any hit.

02 · Telemetry you need

The logsource is category: process_creation, product: windows, copied from the brief, and the selector is written in the Sysmon vocabulary — Image. Sysmon is not present in a default Windows install, and its ProcessCreate section must not be narrowed to a binary allowlist, or the rule returns zero rows. Zero rows reads as quiet when it means blind. A Security 4688 feed carries the same path in NewProcessName, so it needs a field mapping first, plus the Audit Process Creation policy, which is off in stock and baseline configurations.

03 · How the logic works

There is a single block. selection matches Image|endswith against fourteen values — .jpg, .jpeg, .png, .gif, .bmp, .txt, .log, .pdf, .rtf, .doc, .docx, .xls, .xlsx, .csv — and the condition is simply selection. There is no parent gate, no directory scope and no user gate. That extension list is authored by this pipeline; MITRE names the benign_extensions knob but supplies no values. MITRE's other knobs for this analytic — monitored_directories, MagicByteMismatchThreshold, TimeWindow and ParentProcessAnomalyScore — are all named by MITRE and none is expressed in the rule, three of them because they need correlation or a file header. Because the gate is on Image itself, only a direct CreateProcess against the masqueraded path is visible. Renaming the file back to .exe before running it defeats the rule, and so does handing it to a loader such as rundll32.exe or certutil.exe, where Image is the loader and the masqueraded name appears only inside CommandLine. Double-clicking a .jpg-named PE does not execute it either — the shell passes it to the image handler — so something scripted or LOLBin-driven must launch it before this rule has anything to see.

04 · Common false positives

All three false positives are security tooling: malware detonation hosts and analyst sandboxes, purple-team and atomic-test ranges, and phishing-simulation platforms. On an estate with none of those, the rule should be close to silent, which is the argument for its level: high.
Note the tension the reviewer flagged: the first false positive calls itself "the loudest source by a wide margin", and a rule whose loudest benign match dominates is not a high. Either the level drops to medium or that entry's volume claim is overstated for your estate. Resolve it before deploying.

05 · Detection maturity

tier_1: This rule sits at the lowest tier. It has never been run against a log line, its extension list is untested against any real baseline, and its level is disputed by its own first false positive. Treat it as a scaffold to validate, not a detection to trust.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by host, not by extension — sandboxes and ranges are known machines, and trimming the list only widens the blind spot. If ordinary software on your estate runs PE content from a .dat or .log-style name, name that population before you loosen anything. A ParentImage gate on script hosts and LOLBins raises precision; a second selection on CommandLine for the same extensions plus a loader Image is the natural next block for anyone extending this.

Declared by the author

Malware analysis and detonation hosts, which are the loudest source by a wide margin on any estate that has them. Sandbox virtual machines, analyst workstations and EDR detonation features run samples under the names they arrived with, so those endpoints match this rule as their normal daily function and should be excluded by host rather than tuned by extension.
Purple-team and security-training infrastructure. Atomic-test harnesses and adversary-emulation ranges copy a benign binary to a name such as calc.jpg and launch it precisely to prove this control works, producing scheduled bursts of matches from a known set of hosts.
Phishing-simulation and user-awareness platforms, which drop and execute a harmless payload named like an attachment on the endpoints of whoever clicked, generating matches spread across ordinary user machines during a campaign window.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1036.008, evaluated against their process_creation events.

Share this rule

/u/siemphony/4e660768-0c35-4349-afb6-ad04b36be85c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Process started from an image with a document or image extension

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it