Windows Shell-Core: Installed Application Shortcut Indicators for Known Tools
Flags suspicious installation-style activity in Windows shell-core based on EventID 28115 app resolver cache entries for specific tools.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- shell-core
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-14
- Updated
- 2026-07-31
What it detects
This rule flags Windows Shell-Core events that indicate a suspicious application installation based on added shortcuts to the app resolver cache. It matches specific application names and process-related AppIDs associated with networking and remote access tools, which are commonly abused by attackers for discovery and remote access. The detection relies on Shell-Core event telemetry with EventID 28115 and the Name/AppID string contents.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-shell-core-suspicious-shortcut-app-resolver-cache-entries-zenmap-anydesk-83c161b6
title: "Windows Shell-Core: Installed Application Shortcut Indicators for Known Tools"
id: 8df12926-1080-4f7b-ae85-e80e863c1a9c
status: test
description: This rule flags Windows Shell-Core events that indicate a suspicious application installation based on added shortcuts to the app resolver cache. It matches specific application names and process-related AppIDs associated with networking and remote access tools, which are commonly abused by attackers for discovery and remote access. The detection relies on Shell-Core event telemetry with EventID 28115 and the Name/AppID string contents.
references:
- https://nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/shell_core/win_shell_core_susp_packages_installed.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
tags:
- attack.execution
logsource:
product: windows
service: shell-core
detection:
selection_name:
EventID: 28115
Name|contains:
- Zenmap
- AnyDesk
- wireshark
- openvpn
selection_packageid:
EventID: 28115
AppID|contains:
- zenmap.exe
- prokzult ad
- wireshark
- openvpn
condition: 1 of selection_*
falsepositives:
- Packages or applications being legitimately used by users or administrators
level: medium
license: DRL-1.1
related:
- id: 83c161b6-ca67-4f33-8ad0-644a0737cf07
type: derived