huntrule

Suspicious Explorer Executing Path With Trailing Dot via LNK Stomping

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-17
Updated
2026-09-17
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects process execution where the parent explorer.exe launches a target whose command line contains a malformed path element such as a trailing dot or a leading dot-slash which is characteristic of LNK stomping used to strip the Mark-of-the-Web and bypass Smart App Control. Adversaries craft non-standard shortcut targets so explorer canonicalizes and overwrites them removing MotW reputation checks before execution.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange
Malicious BADIIS Driver Dropped to System32 Drivers Directory (via file_event)
Suspicious PowerShell Invoke-Expression with Replace Obfuscation
Suspicious Base64 Decoded Payload Piped to Shell
Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)
Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell
Suspicious Python Interpreter Launching Encoded PowerShell via subprocess
Suspicious PowerShell Download Of Text-Disguised Payload
Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)
Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)
Suspicious Explorer Executing Path With Trailing Dot via LNK Stomping
Pivot detection · T1027 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.