Windows process creation: findstr used with .lnk suffix to trigger shortcut execution

title: "Windows process creation: findstr used with .lnk suffix to trigger shortcut execution"
id: 46586365-68ab-4c3a-9081-983bee1b1c27
status: test
description: This rule identifies Windows processes running find.exe or findstr.exe where the command line ends with a .lnk extension. Attackers may use this pattern to locate and operate on Windows shortcut files for execution or delivery chaining. It relies on process creation telemetry, using the executable path/name and the exact command-line suffix match to .lnk.
references:
  - https://www.bleepingcomputer.com/news/security/hhsgov-open-redirect-used-by-coronavirus-phishing-to-spread-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_findstr_lnk.yml
author: Trent Liffick, Huntrule Team
date: 2020-05-01
modified: 2024-01-15
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1202
  - attack.t1027.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \find.exe
        - \findstr.exe
    - OriginalFileName:
        - FIND.EXE
        - FINDSTR.EXE
  selection_cli:
    CommandLine|endswith:
      - .lnk
      - .lnk"
      - .lnk'
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 33339be3-148b-4e16-af56-ad16ec6c7e7b
    type: derived