Suspicious LNK Double Extension File Created

Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Source: upstream

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1036.007` Masquerading: Double File Extension

Event coverage

Provider	Event ID	Title
Sysmon	11	FileCreate

Stages and Predicates

Stage 1: `selection`

or:
TargetFilename|contains: .doc.
TargetFilename|contains: .docx.
TargetFilename|contains: .jpg.
TargetFilename|contains: .pdf.
TargetFilename|contains: .ppt.
TargetFilename|contains: .pptx.
TargetFilename|contains: .xls.
TargetFilename|contains: .xlsx.
TargetFilename|endswith: .lnk

Stage 2: `not 1 of filter_main_recent`

TargetFilename|contains: '\AppData\Roaming\Microsoft\Windows\Recent\'

Stage 3: `not 1 of filter_optional_*`

or:
or:
Image|endswith: '\excel.exe'
Image|endswith: '\powerpnt.exe'
Image|endswith: '\winword.exe'
TargetFilename|contains: '\AppData\Roaming\Microsoft\Office\Recent\'
Image|endswith: '\excel.exe'
TargetFilename|contains: '\AppData\Roaming\Microsoft\Excel'
Image|endswith: '\powerpnt.exe'
TargetFilename|contains: '\AppData\Roaming\Microsoft\PowerPoint'
Image|endswith: '\winword.exe'
TargetFilename|contains: '\AppData\Roaming\Microsoft\Word'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\excel.exe` corpus 16 (sigma 16) `\powerpnt.exe` corpus 13 (sigma 13) `\winword.exe` corpus 17 (sigma 17)
`TargetFilename`	ends_with	`.lnk` corpus 5 (sigma 5)
`TargetFilename`	match	`.doc.` corpus 2 (sigma 2) `.docx.` corpus 2 (sigma 2) `.jpg.` corpus 2 (sigma 2) `.pdf.` corpus 2 (sigma 2) `.ppt.` corpus 2 (sigma 2) `.pptx.` corpus 2 (sigma 2) `.xls.` corpus 2 (sigma 2) `.xlsx.` corpus 2 (sigma 2) `\AppData\Roaming\Microsoft\Excel` `\AppData\Roaming\Microsoft\Office\Recent\` `\AppData\Roaming\Microsoft\PowerPoint` `\AppData\Roaming\Microsoft\Windows\Recent\` `\AppData\Roaming\Microsoft\Word`