Shell Execution via Windows Shortcut File

[rule]
description = """
Identifies the execution of a script or program extracted from within a Windows shortcut (lnk) file. Adversaries may
embed malicious scripts or files in a shortcut file before delivering it to their target in order to trick them into
executing the payload.
"""
id = "1a88b997-bcae-430a-8a24-7378e8bf5cc4"
license = "Elastic License v2"
name = "Shell Execution via Windows Shortcut File"
os_list = ["windows"]
reference = ["https://docs.google.com/presentation/d/13SsBd0wI0PpyH5C8WlnE_DsJjy1KxAjZ5Dmke9FHfRE/"]
version = "1.0.35"

query = '''
sequence with maxspan=1m
  [file where event.action == "creation" and file.extension : ("lnk", "url") and
   (
    (process.name : ("winrar.exe", "7zFM.exe", "Bandizip.exe") and
     file.path : ("?:\\*\\Temp\\7z*\\*", "?:\\*\\Temp\\Rar$*\\*", "?:\\*\\Temp\\BNZ.*")) or
     /* Issue #374 */
    (process.name : "explorer.exe" and
     /* lowered file.size condition as it creates evasion opportunities */
     file.path : "?:\\*\\AppData\\Local\\Temp\\Temp?_*.lnk")
   )
  ] by process.entity_id
  [process where event.action == "start" and
   process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wmic.exe") and
   (process.parent.name : ("winrar.exe", "7zFM.exe") or
    /* Issue #374 */
    (process.parent.name : "explorer.exe" and process.args_count >= 5))
   ] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"

[[threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.001"
name = "Malicious Link"
reference = "https://attack.mitre.org/techniques/T1204/001/"

[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"