topic Need (XQL) BIOC Rule for starting CMD/Powershell through LNK Files in Cortex XDR Discussions

Need (XQL) BIOC Rule for starting CMD/Powershell through LNK Files

RFeyertag — Sat, 07 Oct 2023 21:36:22 GMT

Hello dear Community,

as you know a very common attack is loading code directly to memory. This happens sometimes through a LNK File or Office Macros.

In my case I want to hunt for LNK Files, which were doubleclicked and a cmd or powershell was started. As I queried my test process (LNK --> powershell --> cmd = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c cmd.exe), there is no indicator, that the powershell was started through a link file.

What am I missing in my plan to hunt for these? Has someone a ready to hunt query?

Rob

Re: Need (XQL) BIOC Rule for starting CMD/Powershell through LNK Files

aspatil — Tue, 10 Oct 2023 10:37:27 GMT

Hello Rob,

Thank you for writing to live community!

My I know, whether you have tested or reproduced the scenario or is they any activity in your environment to hunt with the given command?

Regards.

Re: Need (XQL) BIOC Rule for starting CMD/Powershell through LNK Files

RFeyertag — Thu, 12 Oct 2023 20:21:03 GMT

Hello @aspatil,

I try to hunt these, because as you know, this is an common attack scenario where the adversaries want to load their skripts direct into memory.

I just want to know, if there is a possibility to hunt for these ones.

Rob