Elastic Defend high stable eql

Embedded Executable via Windows Shortcut File

Identifies the execution of a an executable extracted from within a Windows shortcut (lnk) file. Adversaries may embed malicious files in a shortcut file before delivering it to their target in order to trick them into executing the payload.

View Source

Detection Logic

sequence with maxspan=1m
 [ file where event.action != "deletion" and
   (file.Ext.header_bytes : "4d5a*" or file.extension : ("exe", "scr", "pif", "com")) and
   process.name : ("cmd.exe", "powershell.exe") ] by process.entity_id
 [ process where event.action == "start" and
   process.parent.name : ("cmd.exe", "powershell.exe") and process.parent.command_line : "*.lnk*"] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...