MITRE T1187 is only regarding LNK files created on external resources allowing local profile specific sources.

Description

field win.eventdata.image="(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\OUTLOOK\.EXE$|(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\EXCEL\.EXE$|(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\WINWORD\.EXE$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\WINWORD\.EXE$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\EXCEL\.EXE$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft Office\\\\root\\\\Office16\\\\POWERPNT\.EXE$" AND field win.eventdata.targetFilename="(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Office\\\\Recent\\\\.+\.LNK$|(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Internet Explorer\\\\Quick Launch\\\\.+\.LNK$|(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Word\.lnk$|(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Excel\\\\.+\.lnk$|(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Word\\\\.*?\\\\[^\\\\]+\.lnk$|(?i)^[A-Z]:\\\\Users\\\\[\w\.]+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Excel\\\\.+\.lnk$|(?i)^[A-Z]:\\\\Users\\\\[\w\.]+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Office\\\\.+\.lnk$|(?i)^[A-Z]:\\\\Users\\\\[\w\.]+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Office\\\\Recent\\\\.+\.lnk$|(?i)^[A-Z]:\\\\Users\\\\[\w\.]+\\\\AppData\\\\Roaming\\\\Microsoft\\\\PowerPoint\\\\.+\.lnk$"

No license declared

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 92214 Suspicious file created by Microsoft Office process: created · win.eventdata.image = (?i)(winword|excel|powerpnt|outlook)\.exe, win.eventdata.targetFilename = (?i)appdata\\\\.+\.lnk anchor level 15
   field win.eventdata.image="(?i)(winword|excel|powerpnt|outlook)\.exe" AND field win.eventdata.targetFilename="(?i)appdata\\\\.+\.lnk"
2. 900073 MITRE T1187 is only regarding LNK files created on external resources allowing local profile specific sources. exclusion level 1 this rule
   field win.eventdata.image="(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\OUTLOOK\.EXE$|(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\EXCEL\.EXE$|(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\WINWORD\.EXE$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\WINWORD\.EXE$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft Office\\\\(root\\\\)?Office[0-9]+\\\\EXCEL\.EXE$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft Office\\\\root\\\\Office16\\\\POWERPNT\.EXE$" AND field win.eventdata.targetFilename="(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Office\\\\Recent\\\\.+\.LNK$|(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Internet Explorer\\\\Quick Launch\\\\.+\.LNK$|(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Word\.lnk$|(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Excel\\\\.+\.lnk$|(?i)^C:\\\\Users\\\\\w+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Word\\\\.*?\\\\[^\\\\]+\.lnk$|(?i)^[A-Z]:\\\\Users\\\\[\w\.]+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Excel\\\\.+\.lnk$|(?i)^[A-Z]:\\\\Users\\\\[\w\.]+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Office\\\\.+\.lnk$|(?i)^[A-Z]:\\\\Users\\\\[\w\.]+\\\\AppData\\\\Roaming\\\\Microsoft\\\\Office\\\\Recent\\\\.+\.lnk$|(?i)^[A-Z]:\\\\Users\\\\[\w\.]+\\\\AppData\\\\Roaming\\\\Microsoft\\\\PowerPoint\\\\.+\.lnk$"

Rule dependencies

Depends on

• composes · Wazuh if_sid 92214
  • Suspicious file created by Microsoft Office process: created · win.eventdata.image = (?i)(winword|excel|powerpnt|outlook)\.exe, win.eventdata.targetFilename = (?i)appdata\\\\.+\.lnk