Query: detection rule: Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abus
Matching passage: Sigma rule: Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abus. Logsource: windows / file_event. Rule: title: Suspicious LNK Double Extension File Created id: 3215aa19-f060-4332-86d5-5602511f3ca8 related: - id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e type: derived status: test description: 'Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default. ' references: - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/ - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles - https://twitter.com/malwrhunterteam/status/1235135745611960321 - https://twitter.com/luc4m/status/1073181154126254080 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-11-07 modified: 2023-10-18 tags: - attack.stealth - attack.t1036.007 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: .lnk TargetFilename|contains: - .doc. - .docx. - .jpg. - .pdf. - .ppt. - .pptx. - .xls. - .xlsx. filter_main_recent: TargetFilename|contains: \AppData\Roaming\Microsoft\Windows\Recent\ filter_optional_office_recent: Image|endswith: - \excel.exe - \powerpnt.exe - \winword.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Office\Recent\ filter_optional_office_excel: Image|endswith: \excel.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Excel filter_optional_office_powerpoint: Image|endswith: \powerpnt.exe TargetFilename|contains: \AppData\Roaming\Microsoft\PowerPoint filter_optional_office_word: Image|endswith: \winword.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Word condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some tuning is required for other general purpose directories of third party apps level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension/info.yml
Near-miss passage: Sigma rule: Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and. Logsource: windows / process_creation. Rule: title: Github Self-Hosted Runner Execution id: 5bac7a56-da88-4c27-922e-c81e113b20cb status: test description: 'Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. Shai-Hulud is an npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks. ' references: - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/ - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ author: Daniel Koifman (KoifSec) date: 2025-11-29 tags: - attack.command-and-control - attack.t1102.002 - attack.t1071 logsource: category: process_creation product: windows detection: selection_worker_img: - Image|endswith: \Runner.Worker.exe - OriginalFileName: Runner.Worker.dll selection_worker_cli: CommandLine|contains: spawnclient selection_listener_img: - Image|endswith: \Runner.Listener.exe - OriginalFileName: Runner.Listener.dll selection_listener_cli: CommandLine|contains: - run - configure condition: all of selection_worker_* or all of selection_listener_* falsepositives: - Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure - Authorized runner deployments by DevOps/Platform teams following change management - Scheduled runner updates or reconfigurations on existing build agents - Self-hosted runners that follow expected/known naming patterns - Installation via expected/known configuration management tools (reflected mostly as parent process name) level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml