Emotet Loader Execution via LNK File and Command Interpreter

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•4•0•32

Detects the Emotet Epoch4 loader as reported by @malware_traffic in 2022. This specific detection focuses on the execution chain involving a .LNK file delivered via a phishing campaign, which then uses `cmd.exe` or `powershell.exe` to execute commands containing `findstr`, `.vbs`, and `.lnk` in the command line. This indicates an attempt to locate and execute a VBScript from within the LNK file context, a common technique for malware like Emotet to achieve initial execution.