Windows: WinWord Start Menu shortcut via cmd.exe launching a .doc LNK

Flags cmd.exe command lines that invoke a Word Start Menu .lnk to launch a .doc.

FreeUnreviewedSigmamediumv1

windows-winword-start-menu-shortcut-via-cmd-exe-launching-a-doc-lnk-24474469

title: "Windows: WinWord Start Menu shortcut via cmd.exe launching a .doc LNK"
id: 4ff33585-c3f9-48e0-8288-b80cc0e85d8a
status: test
description: This rule identifies process creation where cmd.exe runs a command that includes a Start Menu shortcut path for Word and references a .lnk indicator with a final .doc argument. Such behavior can be used to lure users into opening a document that serves as a delivery or execution trigger during malware staging. Telemetry relies on Windows process creation events capturing the cmd.exe image and its full command line contents.
references:
  - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_lnk_lure_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2024-03-22
tags:
  - attack.execution
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - "/c "
      - .lnk ~
      - Start Menu\Programs\Word
    CommandLine|endswith: .doc
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 24474469-bd80-46cc-9e08-9fbe81bfaaca
    type: derived

What it detects

This rule identifies process creation where cmd.exe runs a command that includes a Start Menu shortcut path for Word and references a .lnk indicator with a final .doc argument. Such behavior can be used to lure users into opening a document that serves as a delivery or execution trigger during malware staging. Telemetry relies on Windows process creation events capturing the cmd.exe image and its full command line contents.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.