ET HUNTING Windows Shortcut Link Padded Whitespace in Command Line Arguments (ZDI-CAN-25373)
This rule detects network traffic indicative of a Windows Shortcut Link (LNK) file containing an unusually large amount of padded whitespace in its command line arguments. This technique is often used to obfuscate malicious commands or exploit vulnerabilities like ZDI-CAN-25373, which was a zero-day exploit related to Windows shortcuts. The rule specifically looks for the LNK file header signature and then uses a PCRE to identify repeated whitespace characters (tab, newline, vertical tab, form feed, carriage return, space) within the file data, suggesting padding for obfuscation or to bypass security controls.
Suricata
