Windows Process Creation: Suspicious LNK Command-Line Whitespace Padding Beyond UI Limit

title: "Windows Process Creation: Suspicious LNK Command-Line Whitespace Padding Beyond UI Limit"
id: 13eac511-23e3-47fc-9a8d-e0434652570a
status: experimental
description: This rule flags Windows process creation events where explorer.exe launches a .lnk and the resulting command line includes suspicious whitespace padding patterns. Attackers can use long, padded LNK command-line arguments containing specific whitespace characters to obscure or extend malicious content beyond what Windows UI surfaces. It relies on process creation telemetry with ParentImage, ParentCommandLine, and CommandLine fields to observe the .lnk origin and the presence of unusual whitespace sequences.
references:
  - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415
  - https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html
  - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_lnk_exec_hidden_cmd.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-03-19
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - ParentImage|endswith: \explorer.exe
    - ParentCommandLine|contains: .lnk
  selection_cmd:
    - CommandLine|contains:
        - "                 "
        - \u0009
        - \u000A
        - \u0011
        - \u0012
        - \u0013
        - \u000B
        - \u000C
        - \u000D
    - CommandLine|re: \n\n\n\n\n\n
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: dd8756e7-a3a0-4768-b47e-8f545d1a751c
    type: derived