{"id":"dd8756e7-a3a0-4768-b47e-8f545d1a751c","title":"Suspicious LNK Command-Line Padding with Whitespace Characters","description":"Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D).\nAdversaries insert non-printable whitespace characters (e.g., Line Feed \\x0A, Carriage Return \\x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.\nThe hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.\nThis rule flags suspicious use of such padding observed in real-world attacks.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-03-19","modified":"","tags":["attack.initial-access","attack.execution","attack.t1204.002"],"technique_ids":["T1204.002"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415","https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html","https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_lnk_exec_hidden_cmd.yml","source_sha256":"9dc68926b192b519ecf556c776bd0cbb44e0feb5f621b80e40dd987998a8e5c0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_lnk_exec_hidden_cmd.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious LNK Command-Line Padding with Whitespace Characters\nid: dd8756e7-a3a0-4768-b47e-8f545d1a751c\nstatus: experimental\ndescription: |\n    Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D).\n    Adversaries insert non-printable whitespace characters (e.g., Line Feed \\x0A, Carriage Return \\x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.\n    The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.\n    This rule flags suspicious use of such padding observed in real-world attacks.\nreferences:\n    - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415\n    - https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html\n    - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-03-19\ntags:\n    - attack.initial-access\n    - attack.execution\n    - attack.t1204.002\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - ParentImage|endswith: '\\explorer.exe'\n        - ParentCommandLine|contains: '.lnk'\n    selection_cmd:\n        - CommandLine|contains:\n              - '                 '  # Padding of SPACE (0x20)\n            # - '\t'  # Horizontal Tab (0x9)\n              - '\\u0009'\n              - '\\u000A' # Line Feed\n              - '\\u0011'\n              - '\\u0012'\n              - '\\u0013'\n              - '\\u000B' # Vertical Tab\n              - '\\u000C'  # \\x0C\n              - '\\u000D'  # \\x0D\n        - CommandLine|re: '\\n\\n\\n\\n\\n\\n' # In some cases \\u000[ABCD] are represented as a newline in the eventlog\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"}],"data_path":"data/detection-rules/dd8756e7-a3a0-4768-b47e-8f545d1a751c.json","kind":"sigma"}