Suspicious Shortcut Modification

[rule]
description = """
Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts are
used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a
system startup process.
"""
id = "8bfc0b79-b3f1-4869-98b9-745b0bf1cb6e"
license = "Elastic License v2"
name = "Suspicious Shortcut Modification"
os_list = ["windows"]
version = "1.0.36"

query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
 not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.hash.sha256 != null and
 (
  process.name : ("rundll32.exe", "regsvr32.exe", "powershell.exe", "wscript.exe", "curl.exe", "certutil.exe", "cmd.exe") or
  ((process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
     not process.code_signature.status : "trusted")
 ) and 
 not process.executable : 
           ("?:\\Program Files\\*.exe", 
            "?:\\Program Files (x86)\\*.exe",
            "?:\\Config.Msi\\*.rbf",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\*\\Installer\\setup.exe",
            "?:\\Windows\\servicing\\TrustedInstaller.exe",
            "?:\\Windows\\SystemApps\\*.exe",
            "?:\\Windows\\System32\\DeviceEnroller.exe",
            "?:\\Windows\\CCM\\UpdateTrustedSites.exe",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
            "C:\\Program Files (x86)\\Lizard\\GPProcessing\\RunScript.exe") and
  not (process.code_signature.subject_name :
          ("Google*",
           "Notepad*",
           "Slack*",
           "Mozilla*",
           "Zoom*",
           "Discord*",
           "Citrix Systems, Inc.") and
       process.code_signature.trusted == true) and
  not (process.executable : "?:\\Users\\*\\Microsoft\\EdgeUpdate\\Install\\*\\setup.exe" and
       process.code_signature.subject_name : "Microsoft*" and process.code_signature.trusted == true) and

  not (process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe" and
        process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation") and 
  not (process.name : ("wscript.exe", "cscript.exe", "cmd.exe") and process.command_line : "*\\\\*\\SysVol\\*") and 
  not (process.name : "cmd.exe" and process.args : "*.bat ") and
  not (process.name : "powershell.exe" and process.args : ("C:\\Windows\\Managetaskbar\\taskband.ps1", "C:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools\\*_AddOfficeIconsToDesktop.ps1")) and
  /* unsigned Notepad++ installer */
  not process.pe.imphash in ("9dda1a1d1f8a1d13ae0297b47046b26e", "7fa974366048f9c551ef45714595665e") and
  not (process.name : "rundll32.exe" and process.args :"shell32.dll,SHCreateLocalServerRunDll" and process.parent.name : "svchost.exe") and
  not process.hash.sha256 in ("7a8998de0f56fb3303d071d6d87bd9c1b4472bc84bba5090993936a8bc819771", "bd68b94f58ad350ccb89f6b9e2b2f473731239fb0aa1902c21cb83e117d66b2e")
 ]
[file where event.action == "overwrite" and file.extension : "lnk" and process.pid != 4 and 
 process.executable : "?:\\*" and
  file.path :
     ("?:\\Users\\*\\Desktop\\*.lnk",
      "?:\\Users\\*\\Microsoft\\Internet Explorer\\Quick Launch\\*.lnk",
      "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.lnk",
      "?:\\Users\\*\\Start Menu\\Programs\\Startup\\*.lnk",
      "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.lnk") and
  file.Ext.header_bytes : "4c000000*" and
  file.name : ("Google Chrome.lnk", "Outlook.lnk", "Microsoft Outlook.lnk","Microsoft Edge.lnk",
               "Mozilla Thunderbird.lnk", "Firefox.lnk", "Word.lnk", "Excel.lnk", "Notepad++.lnk",
               "File Explorer.lnk", "PowerPoint.lnk", "Zoom.lnk", "slack.lnk", "Discord.lnk") and
  not (file.name == "Notepad++.lnk" and process.code_signature.subject_name == "Notepad++")]
'''

min_endpoint_version = "8.6.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.009"
name = "Shortcut Modification"
reference = "https://attack.mitre.org/techniques/T1547/009/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.6.0"