SUSP_LNK_Big_Link_File

Description

Detects a suspiciously big LNK file - maybe with embedded content

Query · yara

condition:
      uint16(0) == 0x004c and uint32(4) == 0x00021401 and filesize > 200KB
Raw source SUSP_LNK_Big_Link_File · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule SUSP_LNK_Big_Link_File {
   meta:
      description = "Detects a suspiciously big LNK file - maybe with embedded content"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-05-15"
      score = 65
      id = "e130f213-53fc-56d6-b1d5-0508a7e18e61"
   condition:
      uint16(0) == 0x004c and uint32(4) == 0x00021401 and filesize > 200KB
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.