Embedded Executable via Windows Shortcut File

[rule]
description = """
Identifies the execution of a an executable extracted from within a Windows shortcut (lnk) file. Adversaries may embed
malicious files in a shortcut file before delivering it to their target in order to trick them into executing the
payload.
"""
id = "9fdd772b-b483-404f-bc02-7ec87e332bec"
license = "Elastic License v2"
name = "Embedded Executable via Windows Shortcut File"
os_list = ["windows"]
reference = ["https://www.x86matthew.com/view_post?id=embed_exe_lnk"]
version = "1.0.28"

query = '''
sequence with maxspan=1m
 [ file where event.action != "deletion" and
   (file.Ext.header_bytes : "4d5a*" or file.extension : ("exe", "scr", "pif", "com")) and
   process.name : ("cmd.exe", "powershell.exe") ] by process.entity_id
 [ process where event.action == "start" and
   process.parent.name : ("cmd.exe", "powershell.exe") and process.parent.command_line : "*.lnk*"] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"

[[threat.technique.subtechnique]]
id = "T1566.002"
name = "Spearphishing Link"
reference = "https://attack.mitre.org/techniques/T1566/002/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.001"
name = "Malicious Link"
reference = "https://attack.mitre.org/techniques/T1204/001/"

[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"