Suspicious Application Installed (via shell-core)

title: Suspicious Application Installed (via shell-core)
id: 76f0f7ad-5f4c-55eb-b823-70c5e326c838
status: stable
description: This rule detects anomalous application installed by looking at the added shortcut to the app resolver cache
references:
    - https://nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3
author: Huntrule Team
date: 2026-02-27
tags:
    - attack.execution
    - attack.command-and-control
    - attack.t1219
logsource:
    product: windows
    service: shell-core
detection:
    selection_name:
        EventID: 28115
        Name|contains:
            - 'Zenmap'
            - 'AnyDesk'
            - 'wireshark'
            - 'openvpn'
    selection_packageid:
        EventID: 28115
        AppID|contains:
            - 'zenmap.exe'
            - 'prokzult ad'
            - 'wireshark'
            - 'openvpn'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium