Elastic Defend high stable eql

Shell Execution via Windows Shortcut File

Identifies the execution of a script or program extracted from within a Windows shortcut (lnk) file. Adversaries may embed malicious scripts or files in a shortcut file before delivering it to their target in order to trick them into executing the payload.

View Source

Detection Logic

sequence with maxspan=1m
  [file where event.action == "creation" and file.extension : ("lnk", "url") and
   (
    (process.name : ("winrar.exe", "7zFM.exe", "Bandizip.exe") and
     file.path : ("?:\\*\\Temp\\7z*\\*", "?:\\*\\Temp\\Rar$*\\*", "?:\\*\\Temp\\BNZ.*")) or
     /* Issue #374 */
    (process.name : "explorer.exe" and
     /* lowered file.size condition as it creates evasion opportunities */
     file.path : "?:\\*\\AppData\\Local\\Temp\\Temp?_*.lnk")
   )
  ] by process.entity_id
  [process where event.action == "start" and
   process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wmic.exe") and
   (process.parent.name : ("winrar.exe", "7zFM.exe") or
    /* Issue #374 */
    (process.parent.name : "explorer.exe" and process.args_count >= 5))
   ] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...