Detection rules › Splunk

Windows User Execution Malicious URL Shortcut File

Author
Teoderick Contreras, Nasreddine Bencherchali, Splunk
Source
upstream

The following analytic detects the creation URL shortcut files, often used by malware like CHAOS ransomware. It leverages the Endpoint.Filesystem datamodel to identify ".url" files created outside common directories, such as "Program Files". This activity can be significant as ".URL" files can be used as mean to trick the user into visiting certain websites unknowingly, or when placed in certain locations such as "\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\", it may allow the execution of malicious code upon system reboot. If confirmed malicious, this could allow an attacker to achieve persistence and execute harmful payloads, potentially leading to further system compromise and data loss.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1204.002 User Execution: Malicious File

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: tstats

tstats WHERE NOT Filesystem.file_path IN ("*:\\Program Files (x86)\\*", "*:\\Program Files\\*", "*:\\Windows\\WinSxS\\*", "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*") Filesystem.file_name="*.url" BY Filesystem.action, Filesystem.dest, Filesystem.file_access_time, Filesystem.file_create_time, Filesystem.file_hash, Filesystem.file_modify_time, Filesystem.file_name, Filesystem.file_path, Filesystem.file_acl, Filesystem.file_size, Filesystem.process_guid, Filesystem.process_id, Filesystem.user, Filesystem.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

StageFieldKindExcluded values
1TargetFilenamein"*:\\Program Files (x86)\\*", "*:\\Program Files\\*", "*:\\Windows\\WinSxS\\*", "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Filesystem.file_nameeq
  • *.url