Findstr Launching .lnk File

Title: Findstr Launching .lnk File
Status: test
Description:Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack
References:
  -https://www.bleepingcomputer.com/news/security/hhsgov-open-redirect-used-by-coronavirus-phishing-to-spread-malware/
Author: Trent Liffick
Date: 2020-05-01
modified:2024-01-15
Tags:

• -'attack.stealth'
• -'attack.t1036'
• -'attack.t1202'
• -'attack.t1027.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\find.exe'
      - '\findstr.exe'
    - OriginalFileName:
      - 'FIND.EXE'
      - 'FINDSTR.EXE'
  selection_cli:
    CommandLine|endswith:
      -'.lnk'
      -'.lnk"'
      -'.lnk''

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium