Shortcut File Modification via Macro Enabled Document

[rule]
description = """
Identifies the creation of a Windows shortcut (lnk) file in the desktop folder and by a Microsoft Office application.
Adversaries may use this technique to execute a malicious command via malicious shortcut HOTKEY, which result in Windows
Explorer (Explorer.exe) spawning the malicious command bypassing detections based on monitoring suspicious MS Office
child processes.
"""
id = "9b13e135-51b4-4e4d-ac46-bb2e479438a6"
license = "Elastic License v2"
name = "Shortcut File Modification via Macro Enabled Document"
os_list = ["windows"]
reference = [
    "https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence",
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.virustotal.com/gui/file/e94873662e05b098939eeca200aa2d4c70230e2333f3bda870c94ac5bd5f06d3",
]
version = "1.0.28"

query = '''
file where event.action != "deletion" and file.extension : "lnk" and
 process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "MSPUB.EXE", "fltldr.exe") and
 file.path : "?:\\Users\\*\\Desktop\\*.lnk" and file.size > 0 and

 /* Hotkey will be reachable from the Desktop, thus we exclude subfolders */
 not file.path : "?:\\Users\\*\\Desktop\\*\\*.lnk" and

 /* macro enabled document */
 process.thread.Ext.call_stack_summary : "*|vbe?.dll*"
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"

[[threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.001"
name = "Malicious Link"
reference = "https://attack.mitre.org/techniques/T1204/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.7.0"