{"id":"3215aa19-f060-4332-86d5-5602511f3ca8","title":"Suspicious LNK Double Extension File Created","description":"Detects the creation of files with an \"LNK\" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the \"LNK\" extension by default.\n","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2022-11-07","modified":"2023-10-18","tags":["attack.stealth","attack.t1036.007"],"technique_ids":["T1036.007"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Some tuning is required for other general purpose directories of third party apps"],"references":["https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/","https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations","https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles","https://twitter.com/malwrhunterteam/status/1235135745611960321","https://twitter.com/luc4m/status/1073181154126254080"],"source_path":"rules/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml","source_sha256":"fdcc97d31da50f4b471b68c191bde780418fe7e1d7b0f0fc55ef822cd7f4d5a7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious LNK Double Extension File Created\nid: 3215aa19-f060-4332-86d5-5602511f3ca8\nrelated:\n    - id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e\n      type: derived\nstatus: test\ndescription: |\n    Detects the creation of files with an \"LNK\" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the \"LNK\" extension by default.\nreferences:\n    - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/\n    - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations\n    - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles\n    - https://twitter.com/malwrhunterteam/status/1235135745611960321\n    - https://twitter.com/luc4m/status/1073181154126254080\nauthor: Nasreddine Bencherchali (Nextron Systems), frack113\ndate: 2022-11-07\nmodified: 2023-10-18\ntags:\n    - attack.stealth\n    - attack.t1036.007\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|endswith: '.lnk'\n        TargetFilename|contains:\n            - '.doc.'\n            - '.docx.'\n            - '.jpg.'\n            - '.pdf.'\n            - '.ppt.'\n            - '.pptx.'\n            - '.xls.'\n            - '.xlsx.'\n    filter_main_recent:\n        TargetFilename|contains: '\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\'\n    filter_optional_office_recent:\n        Image|endswith:\n            # Note: Some additional office application might need to be added\n            - '\\excel.exe'\n            - '\\powerpnt.exe'\n            - '\\winword.exe'\n        TargetFilename|contains: '\\AppData\\Roaming\\Microsoft\\Office\\Recent\\'\n    filter_optional_office_excel:\n        Image|endswith: '\\excel.exe'\n        TargetFilename|contains: '\\AppData\\Roaming\\Microsoft\\Excel'\n    filter_optional_office_powerpoint:\n        Image|endswith: '\\powerpnt.exe'\n        TargetFilename|contains: '\\AppData\\Roaming\\Microsoft\\PowerPoint'\n    filter_optional_office_word:\n        Image|endswith: '\\winword.exe'\n        TargetFilename|contains: '\\AppData\\Roaming\\Microsoft\\Word'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Some tuning is required for other general purpose directories of third party apps\nlevel: medium\nregression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.007","id":"T1036.007","name":"Double File Extension","page":"techniques/enterprise/T1036.007/"}],"data_path":"data/detection-rules/3215aa19-f060-4332-86d5-5602511f3ca8.json","kind":"sigma"}