name: Process Creating LNK file in Suspicious Location
id: 5d814af1-1041-47b5-a9ac-d754e82e9a26
version: 4
date: '2021-01-28'
author: Jose Hernandez, Splunk
type: batch
datamodel: []
description: This search looks for a process launching an `*.lnk` file under `C:\User*`
  or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk"
  AND Filesystem.file_path="C:\\Temp*"  by _time span=1h Filesystem.process_id Filesystem.file_name
  Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)`
  | rename process_id as lnk_pid | join lnk_pid, _time [| tstats `security_content_summariesonly`
  count FROM datamodel=Endpoint.Processes where Processes.process_name=*  by _time
  span=1h Processes.parent_process_id Processes.process_id Processes.process_name
  Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)`
  | rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest process_name
  process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path,
  process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter` '
how_to_implement: You must be ingesting data that records filesystem and process activity
  from your hosts to populate the Endpoint data model. This is typically populated
  via endpoint detection-and-response product, such as Carbon Black, or endpoint data
  sources, such as Sysmon.
known_false_positives: This detection should yield little or no false positive results.
  It is uncommon for LNK files to be executed from temporary or user directories.
references:
- https://attack.mitre.org/techniques/T1566/001/
- https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html
tags:
  analytic_story:
  - Phishing Payloads
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 7
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon.log
  kill_chain_phases:
  - Installation
  - Actions on Objectives
  mitre_attack_id:
  - T1566.002
  nist:
  - ID.AM
  - PR.DS
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Filesystem.file_name
  - Filesystem.file_path
  - Filesystem.process_id
  - Filesystem.file_name
  - Filesystem.file_path
  - Filesystem.file_hash
  - Filesystem.user
  security_domain: network
