Windows: Emotet .LNK Loader Execution via cmd.exe or PowerShell

Alerts on cmd/powershell-launched commands referencing findstr, a .vbs script, and a .lnk file—indicative of shortcut-triggered loader activity.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2022-04-22
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.006Python
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows process creation where the parent process is cmd.exe, explorer.exe, or PowerShell.exe, and the spawned process is cmd.exe or PowerShell.exe with command lines containing findstr, .vbs, and .lnk. This behavior is consistent with scripted loader execution following phishing delivery of a shortcut file. It relies on process creation telemetry with executable paths and full command-line arguments.

Reporting behind it

Related detections9 linkedT1059.006 — drag to rearrange

Suspicious Child Process Spawned by Python Interpreter via Process Creation

Suspicious Kimsuky Python Backdoor Staging in Winii Directory (via file_event)

SynkLoader Python Stager Execution from AppData via pythonw (via process_creation)

Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)

Suspicious Python Startup .pth File Creation for Interpreter Persistence

AteraAgent malicious installations

Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)

Malicious InvisibleFerret Python Loader Execution from Hidden .pyp Directory

StealC Loader Execution via Blender Spawning Script Interpreter (via process_creation)

Windows: Emotet .LNK Loader Execution via cmd.exe or PowerShell

Pivot detection · T1059.006 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-lnk-emotet-loader-execution-via-cmd-powershell-process-creation-1f32d820

title: "Windows: Emotet .LNK Loader Execution via cmd.exe or PowerShell"
id: 58578501-c7e7-47a8-bea1-a5a10005e4ab
status: test
description: This rule matches Windows process creation where the parent process is cmd.exe, explorer.exe, or PowerShell.exe, and the spawned process is cmd.exe or PowerShell.exe with command lines containing findstr, .vbs, and .lnk. This behavior is consistent with scripted loader execution following phishing delivery of a shortcut file. It relies on process creation telemetry with executable paths and full command-line arguments.
references:
  - https://web.archive.org/web/20220422215221/https://twitter.com/malware_traffic/status/1517622327000846338
  - https://twitter.com/Cryptolaemus1/status/1517634855940632576
  - https://tria.ge/220422-1pw1pscfdl/
  - https://tria.ge/220422-1nnmyagdf2/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/Emotet/proc_creation_win_malware_emotet_loader_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2022-04-22
modified: 2024-08-15
tags:
  - attack.execution
  - attack.t1059.006
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \explorer.exe
      - \powershell.exe
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
    CommandLine|contains|all:
      - findstr
      - .vbs
      - .lnk
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 1f32d820-1d5c-43fe-8fe2-feef0c952eb7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL