Windows .LNK Emotet Loader Execution via cmd/powershell Process Creation

title: Windows .LNK Emotet Loader Execution via cmd/powershell Process Creation
id: 58578501-c7e7-47a8-bea1-a5a10005e4ab
status: test
description: This rule flags Windows process creation where the command line includes both findstr and .vbs plus references a .lnk file, with parent and/or process image ending in cmd.exe, powershell.exe, or explorer.exe. This behavior is consistent with execution paths attackers use after phishing lures, where shortcut files trigger subsequent staging or script-based loader activity. The detection relies on Windows process creation telemetry, including Image, ParentImage, and CommandLine contents.
references:
  - https://web.archive.org/web/20220422215221/https://twitter.com/malware_traffic/status/1517622327000846338
  - https://twitter.com/Cryptolaemus1/status/1517634855940632576
  - https://tria.ge/220422-1pw1pscfdl/
  - https://tria.ge/220422-1nnmyagdf2/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Emotet/proc_creation_win_malware_emotet_loader_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2022-04-22
modified: 2024-08-15
tags:
  - attack.execution
  - attack.t1059.006
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \explorer.exe
      - \powershell.exe
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
    CommandLine|contains|all:
      - findstr
      - .vbs
      - .lnk
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 1f32d820-1d5c-43fe-8fe2-feef0c952eb7
    type: derived