Symbolic OR Hard File Link Created (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204.002` User Execution: Malicious File
Persistence	`T1547.009` Boot or Logon Autostart Execution: Shortcut Modification
Privilege Escalation	`T1547.009` Boot or Logon Autostart Execution: Shortcut Modification

References

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '6105.6584'
title: Symbolic OR Hard File Link Created
description: 'Symbolic links are ways of referencing other files or programs that
  will be opened or executed when the shortcut is clicked or executed by a system
  startup process. -- Threat Actor Association: APT29/Nobelium, APT43, Arid Viper/APT
  C-23, Kimsuky, Lancefly, Gamaredon Group/Shuckworm,/Armageddon, SideWinder, TA505,
  TA576, UAC-0057 (GhostWriter), UNC2589, UNC4990, Wizard Spider -- Software Association:
  Astaroth, Black Basta, Bumblebee, Emotet, MINEBRIDGE, Qakbot/Qbot, Trickbot, Remcos
  RAT - #TrendingThreat #Russia #Ukraine - Atomics T1546.008 Test #3'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) ((("New-Item"
  OR TERM(ni)) (TERM(SymbolicLink) OR TERM(hardlink))) OR TERM(mklink)) | table _time,
  host, user, process, process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon autostart execution:shortcut modification
- privilege-escalation:boot or logon autostart execution:shortcut modification
- execution:user execution:malicious file
technique_id:
- T1547.009
- T1204.002
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
- https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) ((("New-Item" OR TERM(ni)) (TERM(SymbolicLink) OR TERM(hardlink))) OR TERM(mklink))

Stage 2: `table`

| table _time, host, user, process, process_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"New-Item"`
1	`ni`
1	`SymbolicLink`
1	`hardlink`
1	`mklink`