Windows: Emotet .LNK Loader Execution via cmd.exe or PowerShell

Alerts on cmd/powershell-launched commands referencing findstr, a .vbs script, and a .lnk file—indicative of shortcut-triggered loader activity.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2022-04-22
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.006Python
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows process creation where the parent process is cmd.exe, explorer.exe, or PowerShell.exe, and the spawned process is cmd.exe or PowerShell.exe with command lines containing findstr, .vbs, and .lnk. This behavior is consistent with scripted loader execution following phishing delivery of a shortcut file. It relies on process creation telemetry with executable paths and full command-line arguments.

Reporting behind it

Related detections9 linkedT1059.006 — drag to rearrange

Possible Trojanised Python Native Extension Load of gradient Module

Malicious AI CLI Anti-Attribution and Permission Bypass Flags

Suspicious Python HTTP Server Staging for Payload Delivery

Suspicious Python Base64 Encoded Command Execution (via process_creation)

Suspicious __init__.py Drop in Public Directory by Slow Pisces (via file_event)

Malicious Python Reverse Shell One-Liner Execution (via process_creation)

Suspicious Silver Fox Backdoor Execution via pythonw appclient Module (via process_creation)

Suspicious Malicious MCP Package devtools-assistant Execution (via process_creation)

Malicious GitVenom Python Fernet Decrypt-and-Execute Loader via process_creation

Windows: Emotet .LNK Loader Execution via cmd.exe or PowerShell

Pivot detection · T1059.006 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-lnk-emotet-loader-execution-via-cmd-powershell-process-creation-1f32d820

title: "Windows: Emotet .LNK Loader Execution via cmd.exe or PowerShell"
id: 58578501-c7e7-47a8-bea1-a5a10005e4ab
status: test
description: This rule matches Windows process creation where the parent process is cmd.exe, explorer.exe, or PowerShell.exe, and the spawned process is cmd.exe or PowerShell.exe with command lines containing findstr, .vbs, and .lnk. This behavior is consistent with scripted loader execution following phishing delivery of a shortcut file. It relies on process creation telemetry with executable paths and full command-line arguments.
references:
  - https://web.archive.org/web/20220422215221/https://twitter.com/malware_traffic/status/1517622327000846338
  - https://twitter.com/Cryptolaemus1/status/1517634855940632576
  - https://tria.ge/220422-1pw1pscfdl/
  - https://tria.ge/220422-1nnmyagdf2/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Emotet/proc_creation_win_malware_emotet_loader_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2022-04-22
modified: 2024-08-15
tags:
  - attack.execution
  - attack.t1059.006
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \explorer.exe
      - \powershell.exe
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
    CommandLine|contains|all:
      - findstr
      - .vbs
      - .lnk
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 1f32d820-1d5c-43fe-8fe2-feef0c952eb7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL