Detect Shebang Code Inside Files With Unusual Extensions
Query
DeviceFileEvents
| extend AF=parse_json(AdditionalFields) | where tostring(AF.FileType) == "Shebang"
| where FileName has_any (".txt", ".log", ".dat", ".tmp", ".conf", ".jpg", ".png", ".pdf")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLineAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1036.008 | Masquerading: Masquerade File Type |
Author: Sergio Albea (11/06/2026)
Detect Shebang code inside files with unusual extensions
Description: Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
Distinct scripts can not look dangerous based on their extension, but they are still executable files. In environments with macOS, Linux, WSL, Git Bash or Python Launcher, this can help to identify scripts renamed to hide their real purpose.
Explanation
This query is designed to detect potentially suspicious files on a system by looking for scripts that use a "shebang" (#!) but have unusual file extensions. Here's a simple breakdown of what the query does:
-
Context: The query is related to a technique called "Masquerading: Masquerade File Type" from the MITRE ATT&CK framework. This technique involves disguising a file's true nature by giving it a misleading file extension.
-
Purpose: The goal is to identify files that might be trying to hide their true purpose by using a shebang line (which specifies the script interpreter) but have extensions that are not typically associated with executable scripts.
-
Targeted File Extensions: The query specifically looks for files with extensions like
.txt,.log,.dat,.tmp,.conf,.jpg,.png, and.pdf. These extensions are usually associated with non-executable files, so finding a shebang in such files could indicate an attempt to disguise a script. -
Query Details:
- It searches through
DeviceFileEventsto find files with a "Shebang" file type. - It filters these files to only include those with the specified extensions.
- It then projects (or selects) specific details about these files, such as the timestamp, device name, action type, file name, folder path, SHA256 hash, and information about the process that initiated the file.
- It searches through
In summary, this query helps identify potentially malicious scripts that are disguised as harmless files by checking for shebang lines in files with unexpected extensions.
