Detection: Process Creating LNK file in Suspicious Location

Updated Date: 2026-01-23 ID: 5d814af1-1041-47b5-a9ac-d754e82e9a26 Author: Jose Hernandez, Michael Haag, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects a process creating a .lnk file in suspicious locations such as C:\User* or *\Local\Temp\*. It leverages filesystem and process activity data from the Endpoint data model to identify this behavior. This activity can be significant because creating .lnk files in these directories is a common indicator of spear phishing tools to establish persistence or execute malicious payloads. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code, or further compromise the system.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6FROM datamodel=Endpoint.Filesystem where
 7
 8Filesystem.action="created"
 9Filesystem.file_name="*.lnk"
10Filesystem.file_path IN (
11  "*:\\AppData\\Local\\Temp\\*",
12  "*:\\Temp\\*",
13  "*:\\Users\\*",
14  "*:\\Windows\\Temp\\*"
15)
16NOT Filesystem.file_path IN (
17  "*\\AppData\\Local\\Microsoft\\Windows\\WinX\\*",
18  "*\\AppData\\Roaming\\Microsoft\\Excel\\*",
19  "*\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*",
20  "*\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*",
21  "*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*",
22  "*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*",
23  "*\\AppData\\Roaming\\Microsoft\\Word\\*",
24  "*\\Links\\*",
25  "*\\OneDrive *"
26)
27
28by Filesystem.action Filesystem.dest Filesystem.file_access_time
29   Filesystem.file_create_time Filesystem.file_hash
30   Filesystem.file_modify_time Filesystem.file_name
31   Filesystem.file_path Filesystem.file_acl Filesystem.file_size
32   Filesystem.process_guid Filesystem.process_id
33   Filesystem.user Filesystem.vendor_product
34
35
36| `drop_dm_object_name(Filesystem)`
37
38| `security_content_ctime(firstTime)`
39
40| `security_content_ctime(lastTime)`
41
42| `process_creating_lnk_file_in_suspicious_location_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 11	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
process_creating_lnk_file_in_suspicious_location_filter	`search *`

process_creating_lnk_file_in_suspicious_location_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1566.002	Spearphishing Link	Initial Access

Delivery

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Risk Event	True

This configuration file applies to all detections of type anomaly. These detections will use Risk Based Alerting.

Implementation

You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon.

Known False Positives

False positives are expected to occur, since .lnk files can be created legitimately by users or applications. To reduce false positives. To reduce noise, think of joining this to the process that created the LNK file and see if it's a known good process.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message:

A shortcut file [$file_name$] was created in $file_path$ on the host $dest$

Risk Object	Risk Object Type	Risk Score	Threat Objects
dest	system	30	file_path, file_name
user	user	30	file_path, file_name

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`
Integration	✅ Passing	Dataset	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`	`XmlWinEventLog`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 14