Windows Shell-Core: Suspicious Shortcut/App Resolver Cache Entries (Zenmap/AnyDesk/Wireshark/OpenVPN)

Flags suspicious installation-style activity in Windows shell-core based on EventID 28115 app resolver cache entries for specific tools.

FreeUnreviewedSigmamediumv1

windows-shell-core-suspicious-shortcut-app-resolver-cache-entries-zenmap-anydesk-83c161b6

title: "Windows Shell-Core: Suspicious Shortcut/App Resolver Cache Entries (Zenmap/AnyDesk/Wireshark/OpenVPN)"
id: 8df12926-1080-4f7b-ae85-e80e863c1a9c
status: test
description: This rule identifies Windows events where the shell-core application resolver cache records a newly added shortcut associated with specific networking, remote access, or scanning tools (e.g., Zenmap, AnyDesk, Wireshark, OpenVPN). Attackers often drop or stage legitimate tools to blend in and enable discovery, remote access, or traffic inspection, making unexpected installs or shortcut creation suspicious. It relies on Windows Shell-Core telemetry with EventID 28115 and matches process/app identifiers that contain the listed tool names.
references:
  - https://nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/shell_core/win_shell_core_susp_packages_installed.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
tags:
  - attack.execution
logsource:
  product: windows
  service: shell-core
detection:
  selection_name:
    EventID: 28115
    Name|contains:
      - Zenmap
      - AnyDesk
      - wireshark
      - openvpn
  selection_packageid:
    EventID: 28115
    AppID|contains:
      - zenmap.exe
      - prokzult ad
      - wireshark
      - openvpn
  condition: 1 of selection_*
falsepositives:
  - Packages or applications being legitimately used by users or administrators
level: medium
license: DRL-1.1
related:
  - id: 83c161b6-ca67-4f33-8ad0-644a0737cf07
    type: derived

What it detects

This rule identifies Windows events where the shell-core application resolver cache records a newly added shortcut associated with specific networking, remote access, or scanning tools (e.g., Zenmap, AnyDesk, Wireshark, OpenVPN). Attackers often drop or stage legitimate tools to blend in and enable discovery, remote access, or traffic inspection, making unexpected installs or shortcut creation suspicious. It relies on Windows Shell-Core telemetry with EventID 28115 and matches process/app identifiers that contain the listed tool names.

Known false positives

Packages or applications being legitimately used by users or administrators

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.