diff --git a/backend/app/services/evidence_service.py b/backend/app/services/evidence_service.py
index 70393aa..bc9f9f7 100644
--- a/backend/app/services/evidence_service.py
+++ b/backend/app/services/evidence_service.py
@@ -57,6 +57,8 @@ ALLOWED_EXTENSIONS: frozenset[str] = frozenset({
     ".zip", ".tar", ".gz", ".7z",
     # Literal argument value
     ".har", ".eml", ".msg",
+    # Red team artifacts shared with Blue for detection analysis.
+    ".exe",
 })
 
 
diff --git a/backend/tests/test_evidence_file_validation.py b/backend/tests/test_evidence_file_validation.py
new file mode 100644
index 0000000..5141419
--- /dev/null
+++ b/backend/tests/test_evidence_file_validation.py
@@ -0,0 +1,28 @@
+"""Evidence upload file-type validation — Red team artifacts (e.g. .exe
+payloads) must be shareable with Blue for detection analysis."""
+
+import pytest
+
+from app.domain.errors import BusinessRuleViolation
+from app.services.evidence_service import validate_file
+
+
+def test_exe_files_are_allowed():
+    validate_file("payload.exe", 1024)
+
+
+def test_allowed_extensions_still_pass():
+    for name in ("screenshot.png", "notes.pdf", "capture.pcap", "archive.zip"):
+        validate_file(name, 1024)
+
+
+def test_disallowed_extension_still_rejected():
+    with pytest.raises(BusinessRuleViolation):
+        validate_file("script.sh", 1024)
+
+
+def test_oversized_file_still_rejected():
+    from app.services.evidence_service import MAX_UPLOAD_SIZE
+
+    with pytest.raises(BusinessRuleViolation):
+        validate_file("payload.exe", MAX_UPLOAD_SIZE + 1)