SID 1:62023

Rule Category

OS-WINDOWS -- Snort has detected traffic targeting vulnerabilities in a Windows-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-WINDOWS Microsoft Windows potential malicious Shortcut file download attempt

Rule Explanation

This rule looks for crafted Microsoft Windows shortcut files that point the "URL" property to a remote location. Attackers have been observed utilizing Windows shortcut files to leak NTLM hashes and also to pull down additional malicious payloads.

What To Look For

This rule fires on attempts to download what is a potentially malicious Shortcut files that are related to multiple Windows vulnerabilities.

Known Usage

Attacks/Scans seen in the wild

False Positives

Known false positives, with the described conditions

This rule looks for Windows shortcut files that point to remote locations where the destination is an IP address. Although this is a tactic often employed by malicous actors to leak NTLM hashes and pull down additional malware payloads, this rule can also potentially fire on legitimate attempts to use these shortcut files to download arbitrary files.

Contributors

Cisco Talos Intelligence Group