splApache-2.0from splunk/security_content
Process Creating LNK file in Suspicious Location
The following analytic detects a process creating a `.lnk` file in suspicious locations such as `C:\User*` or `*\Local\Temp\*`. It leverages filesystem and process activity data from the Endpoint data model to identify this behavior. This activity can be significant because creating `.lnk` files in these directories is a common indicator of spear phishing tools to establish persistence or execute malicious payloads. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code, or further compromise the system.
Quality
67
FP risk
—
Forks
0
Views
0
Rule sourcedetections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
FROM datamodel=Endpoint.Filesystem where
Filesystem.action="created"
Filesystem.file_name="*.lnk"
Filesystem.file_path IN (
"*:\\AppData\\Local\\Temp\\*",
"*:\\Temp\\*",
"*:\\Users\\*",
"*:\\Windows\\Temp\\*"
)
NOT Filesystem.file_path IN (
"*\\AppData\\Local\\Microsoft\\Windows\\WinX\\*",
"*\\AppData\\Roaming\\Microsoft\\Excel\\*",
"*\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*",
"*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*",
"*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*",
"*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*",
"*\\AppData\\Roaming\\Microsoft\\Word\\*",
"*\\Links\\*",
"*\\OneDrive *"
)
by Filesystem.action Filesystem.dest Filesystem.file_access_time
Filesystem.file_create_time Filesystem.file_hash
Filesystem.file_modify_time Filesystem.file_name
Filesystem.file_path Filesystem.file_acl Filesystem.file_size
Filesystem.process_guid Filesystem.process_id
Filesystem.user Filesystem.vendor_product
| `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `process_creating_lnk_file_in_suspicious_location_filter`