false positives are expected to occur, since `.lnk` files can be created legitimately by users or applications. to reduce false positives. to reduce noise, think of joining this to the process that created the lnk file and see if it's a known good process.

Techniques

T1566.002

Sample rules

Process Creating LNK file in Suspicious Location

source: splunk
technicques:
- T1566.002

Description

The following analytic detects a process creating a .lnk file in suspicious locations such as C:\User* or *\Local\Temp\*. It leverages filesystem and process activity data from the Endpoint data model to identify this behavior. This activity can be significant because creating .lnk files in these directories is a common indicator of spear phishing tools to establish persistence or execute malicious payloads. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code, or further compromise the system.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

FROM datamodel=Endpoint.Filesystem where

Filesystem.action="created"
Filesystem.file_name="*.lnk"
Filesystem.file_path IN (
  "*:\\AppData\\Local\\Temp\\*",
  "*:\\Temp\\*",
  "*:\\Users\\*",
  "*:\\Windows\\Temp\\*"
)
NOT Filesystem.file_path IN (
  "*\\AppData\\Local\\Microsoft\\Windows\\WinX\\*",
  "*\\AppData\\Roaming\\Microsoft\\Excel\\*",
  "*\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*",
  "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*",
  "*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*",
  "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*",
  "*\\AppData\\Roaming\\Microsoft\\Word\\*",
  "*\\Links\\*",
  "*\\OneDrive *"
)

by Filesystem.action Filesystem.dest Filesystem.file_access_time
   Filesystem.file_create_time Filesystem.file_hash
   Filesystem.file_modify_time Filesystem.file_name
   Filesystem.file_path Filesystem.file_acl Filesystem.file_size
   Filesystem.process_guid Filesystem.process_id
   Filesystem.user Filesystem.vendor_product


| `drop_dm_object_name(Filesystem)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `process_creating_lnk_file_in_suspicious_location_filter`