Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
19
18
4
3
3
Contributors
10
6
5
4
4
Categories
25
22
15
12
11
Platforms
51
2
Products / Services
18
11
11
6
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
IDS Protocols
2
KQL Query
KQL Query from file: Detect LNK Stomping
KQL Query
Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_unidentified_nov_18.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This rule detects the creation, modification, copying, or moving of Windows shortcut (.lnk) files into sensitive user directories such as Desktop, Documents, and Start Menu folders. Adversaries often use .lnk files for persistence, execution, or to deliver malicious payloads, especially when placed in locations that are frequently accessed or automatically executed by the system or user.
Page 3 of 3