Browse Rules

Search and filter across all detection sources

112 rules

sekoia unknown yara

apt_gamaredon_lnk_spreader [yara_rules]

Detects LNK generated by Gamaredon LNK spreader
sekoia unknown yara

lnk_astaroth [yara_rules]

Astaroth LNK
signature-base unknown yara

SUSP_LNK_lnkfileoverRFC [yara]

Detects APT lnk files that run double extraction and launch routines with autoruns
sekoia unknown yara

downloader_kimsuky_lnk [yara_rules]

Detect Kimsuky LNK
signature-base unknown yara

LNK_Malicious_Nov1 [yara]

Detects a suspicious LNK file
signature-base unknown yara

Dropper_LNK_LNKSmasher_1 [yara]

The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID.
sekoia unknown yara

guloader_lnk_file [yara_rules]

LNK file delivering Guloader
signature-base unknown yara

lnk_detect [yara]

Detects malicious LNK file from NCSC report
signature-base unknown yara

SUSP_LNK_SuspiciousCommands [yara]

Detects LNK file with suspicious content
chronicle unknown yara-l

suspicious_unusual_location_lnk_file

Shortcut file (.lnk) in an unusual location
sekoia unknown yara

apt_lazarus_dangerouspassword_lnk [yara_rules]

Detects Lazarus DangerousPassword LNKs
sekoia unknown yara

koiloader_lnk [yara_rules]

LNK file leading to deploy KoiLoader
sekoia unknown yara

apt_gamaredon_lnk [yara_rules]

Detects lnk file used by Gamaredon
signature-base unknown yara

MAL_Janicab_LNK [yara]

detect LNK files used in Janicab infection chain
sekoia unknown yara

apt_flightnight_malicious_lnk [yara_rules]

Detects malicious LNK used by FlightNight
sekoia unknown yara

malicious_lnk_exploiting_webdav_share_generic [yara_rules]

Detects some malicious LNK
sekoia unknown yara

trojan_win_bbtok_lnk_sep23 [yara_rules]

Finds BBTok installation LNK file
chronicle low yara-l

Suspicious Unusual Location LNK File

Detects creation and movement of .lnk files to specific folders
sekoia unknown yara

apt_gamaredon_gamaredon_lnk_usb_spreader [yara_rules]

Detects Gamaredon LNK USB Spreader
sekoia unknown yara

apt_kimsuky_malicious_gotopwsh_lnk [yara_rules]

Detects malicious LNK used by Kimsuky
sekoia unknown yara

apt_sugargh0stcampaign_malicious_lnk [yara_rules]

Detects malicious LNK used in SugarGh0st campaign
signature-base unknown yara

SUSP_DOC_LNK_in_ZIP [yara]

Detects suspicious .doc.lnk file in ZIP archive
sublime high mql

Attachment: LNK file

Recursively scans files and archives to detect LNK connection files. LNK files can be weaponised to execute arbitrary commands including unpacking and running executable content embedded within the file itself.

hayabusa medium sigma

Potentially Suspicious WebDAV LNK Execution

Detects possible execution via LNK file accessed on a WebDAV server.
sekoia unknown yara

apt_gamaredon_lnks_farl139_hostname [yara_rules]

Detects some hostname used in Gamaredon LNKs