Windows File Events: Detect explorer-expanded LNK persistence in Startup folder with embedded CLSID

title: "Windows File Events: Detect explorer-expanded LNK persistence in Startup folder with embedded CLSID"
id: 90ce7e31-f62b-4ddb-8b23-ae0f71b4b5cc
status: test
description: This rule flags file creation or modification where a shortcut (.lnk) is placed in the Windows Startup folder and the shortcut path/filename contains the specific {0AFACED1-E828-11D1-9187-B532F1E9575D} marker tied to folder shortcut behavior. It focuses on cases where the initiating process is Windows Explorer (explorer.exe), consistent with victims expanding ZIP content that leads to a malicious shortcut being written to Startup for persistence. Telemetry relies on Windows file event fields for TargetFilename/contents and the originating Image path.
references:
  - https://twitter.com/jonasLyk/status/1549338335243534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ripzip_attack.yml
author: Greg (rule), Huntrule Team
date: 2022-07-21
modified: 2023-01-05
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
      - \Microsoft\Windows\Start Menu\Programs\Startup
      - .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D}
    Image|endswith: \explorer.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a6976974-ea6f-4e97-818e-ea08625c52cb
    type: derived