Query: detect Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abus in logs
Matching passage: Sigma rule: Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abus. Logsource: windows / file_event. Rule: title: Suspicious LNK Double Extension File Created id: 3215aa19-f060-4332-86d5-5602511f3ca8 related: - id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e type: derived status: test description: 'Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default. ' references: - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/ - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles - https://twitter.com/malwrhunterteam/status/1235135745611960321 - https://twitter.com/luc4m/status/1073181154126254080 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-11-07 modified: 2023-10-18 tags: - attack.stealth - attack.t1036.007 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: .lnk TargetFilename|contains: - .doc. - .docx. - .jpg. - .pdf. - .ppt. - .pptx. - .xls. - .xlsx. filter_main_recent: TargetFilename|contains: \AppData\Roaming\Microsoft\Windows\Recent\ filter_optional_office_recent: Image|endswith: - \excel.exe - \powerpnt.exe - \winword.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Office\Recent\ filter_optional_office_excel: Image|endswith: \excel.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Excel filter_optional_office_powerpoint: Image|endswith: \powerpnt.exe TargetFilename|contains: \AppData\Roaming\Microsoft\PowerPoint filter_optional_office_word: Image|endswith: \winword.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Word condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some tuning is required for other general purpose directories of third party apps level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension/info.yml
Near-miss passage: Sigma rule: Detects instances where an HTTP service on an OpenCanary node has received a GET request.. Logsource: opencanary / application. Rule: title: OpenCanary - HTTP GET Request id: af6c3078-84cd-4c68-8842-08b76bd81b13 status: test description: Detects instances where an HTTP service on an OpenCanary node has received a GET request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.initial-access - attack.t1190 logsource: category: application product: opencanary detection: selection: logtype: 3000 condition: selection falsepositives: - Unlikely level: high