huntrule

Windows: Word LNK via cmd.exe Start Menu shortcut leading to .doc execution

Flags cmd.exe command lines that invoke a Word Start Menu .lnk to launch a .doc.

FreeReviewedSigma · Medium · v5
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2024-03-22
Updated
2026-07-31
AnalysisDetection
title: "Windows: Word LNK via cmd.exe Start Menu shortcut leading to .doc execution"
id: 4ff33585-c3f9-48e0-8288-b80cc0e85d8a
status: test
description: This rule identifies process executions where cmd.exe is launched to run a Start Menu shortcut for Word and the command line ends with a .doc file. Attackers commonly use shortcut-driven document execution to blend execution steps and trigger follow-on payload activity. The detection relies on process creation telemetry, specifically the cmd.exe image path and the contents of the associated command line.
references:
  - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_lnk_lure_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2024-03-22
tags:
  - attack.execution
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - "/c "
      - .lnk ~
      - Start Menu\Programs\Word
    CommandLine|endswith: .doc
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 24474469-bd80-46cc-9e08-9fbe81bfaaca
    type: derived