Rare Lnk File Created On Desktop
Query
let Threshold = 1000;
DeviceEvents
| where ActionType =~ 'ShellLinkCreateFileEvent'
| where FolderPath has 'Desktop'
| extend ShellLinkIconPath = parse_json(AdditionalFields).ShellLinkIconPath, ShellLinkWorkingDirectory = parse_json(AdditionalFields).ShellLinkWorkingDirectory
// Enrich data with FileProfile
| invoke FileProfile(InitiatingProcessSHA256, 10000)
| where GlobalPrevalence <= Threshold or isempty(GlobalPrevalence)
| project-reorder Timestamp, ActionType, FolderPath, ShellLinkIconPath, ShellLinkWorkingDirectory, InitiatingProcessAccountUpnAbout this query
Explanation
This query is designed to identify unusual or rare .lnk (shortcut) files that have been created on the desktop of a device. These files can be used by attackers to trick users into running malicious software or to maintain access to a compromised system. The query works by:
- Looking for events where a shortcut file is created (
ShellLinkCreateFileEvent) specifically on the desktop. - Extracting additional details about the shortcut, such as its icon path and working directory.
- Using the
FileProfilefunction to check how common the file is globally. It filters out files that are commonly seen, focusing only on those with low prevalence (less than or equal to 1000 occurrences globally) or those with no prevalence data. - Presenting the results with relevant details like the timestamp, action type, folder path, icon path, working directory, and the account that initiated the process.
This approach helps in identifying potentially malicious shortcuts that could indicate an attacker's attempt to establish persistence or trick users into executing harmful code.
