Elastic Defend high stable eql

Suspicious Windows Shortcut File Creation or Modification

Identifies when an unusually large Windows Shortcut (LNK) file is created or modified with a suspicious file name. Adversaries may embed malicious scripts or files in a shortcut file before delivering it to their target and tricking them into executing the payload. Adversaries also leverage malicious shortcut files to maintain persistence on an endpoint and ensure that their malicious code is executed when a routine event occurs such as when a user logs in to Windows.

View Source

Detection Logic

file where event.action == "creation" and

   // limited to common archive file handlers
    process.name : ("winrar.exe", "7zFM.exe") and

    // Match shortcut (LNK) files by header (4C 00 00 00)
    file.Ext.header_bytes : "4c000000*" and

    // LNK files larger than 200,000 bytes
    file.size > 200000 and

    // LNK files with suspicious file extension combinations
    file.name : (
      "*.pdf.lnk",
      "*.doc.lnk",
      "*.docx.lnk",
      "*.ppt.lnk",
      "*.pptx.lnk",
      "*.xls.lnk",
      "*.xlsx.lnk",
      "*.rtf.lnk",
      "*.jpg.lnk",
      "*.png.lnk",
      "*.html.lnk",
      "*.htm.lnk",
      "*.txt.lnk",
      "*.exe.lnk",
      "*.mp4.lnk",
      "*.avi.lnk",
      "*.bat.lnk",
      "*.rar.lnk",
      "*.zip.lnk",
      "*.img.lnk",
      "*.iso.lnk"
      )

Field Validations

Loading…

Comments (0)

Loading comments...