H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Alternative Execution Due to Deceptive Filenames

The extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a denial of service or expose sensitive information.

Technique
TypeTechnique
External ID—
First seen2026-10-17
Last seen2026-10-17

Confidence

—

The extension of a file name is often used in various contexts to determine the application that is used to open and use it. If an attacker can cause an alternative application to be used, it may be able to execute malicious code, cause a denial of service or expose sensitive information.

Labels

attack-patterncapec
4 recorded

Relationships

child-of
from Adding a Space to a File Extension
Technique
child-of
to File Manipulation
Technique
child-of
from Cause Web Server Misclassification
Technique
mapped-to
to Double File Extension
Technique
1 external

References

capec
CAPEC-635
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance