Windows PowerShell Decryption-Like Activity Involving .LNK File Processing
Identifies PowerShell runs that enumerate and process *.lnk content using byte-level reads/writes consistent with decryption staging.
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-30
- Updated
- 2026-07-30
What it detects
This rule flags PowerShell executions (powershell.exe or pwsh.exe) whose command lines reference reading .LNK files and performing decryption-like byte handling. It looks for Get-ChildItem/dir enumeration, content retrieval (e.g., Get-Content/ReadAllBytes), and output via WriteAllBytes with properties expansion on *.lnk files. This matters because attackers can use PowerShell to transform embedded or stored data from shortcut files to stage subsequent payloads. Telemetry relies on Windows process creation data including Image/OriginalFileName and the full CommandLine.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Decryption-Like Activity Involving .LNK File Processing
id: f6e31262-5239-45aa-aaf3-f9ba46f64818
status: test
description: This rule flags PowerShell executions (powershell.exe or pwsh.exe) whose command lines reference reading .LNK files and performing decryption-like byte handling. It looks for Get-ChildItem/dir enumeration, content retrieval (e.g., Get-Content/ReadAllBytes), and output via WriteAllBytes with properties expansion on *.lnk files. This matters because attackers can use PowerShell to transform embedded or stored data from shortcut files to stage subsequent payloads. Telemetry relies on Windows process creation data including Image/OriginalFileName and the full CommandLine.
references:
- https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_decrypt_pattern.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-30
modified: 2023-12-05
tags:
- attack.execution
logsource:
product: windows
category: process_creation
detection:
selection_img:
Image|endswith:
- \powershell.exe
- \pwsh.exe
OriginalFileName:
- PowerShell.EXE
- pwsh.dll
selection_cli_dir:
CommandLine|contains:
- "Get-ChildItem "
- "dir "
- "gci "
- "ls "
selection_cli_gc:
CommandLine|contains:
- "Get-Content "
- "gc "
- "cat "
- "type "
- ReadAllBytes
selection_cli_specific:
- CommandLine|contains|all:
- " ^| "
- \*.lnk
- -Recurse
- "-Skip "
- CommandLine|contains|all:
- " -ExpandProperty "
- \*.lnk
- WriteAllBytes
- " .length "
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 434c08ba-8406-4d15-8b24-782cb071a691
type: derived