High Severity
Attachment: LNK with embedded content
Description
Emotet has been observed to embed executable content within an LNK file to deliver and execute VBScript when launched.
Similar research has demonstrated how this concept may be applied to deliver and launch an embedded executable via PowerShell.
References
type.inbound
and (
any(attachments,
.file_extension == "lnk"
and any(file.explode(.),
.file_extension =~ "lnk"
and any(.scan.exiftool.fields, (.key == "TargetFileSize" and .value == "0"))
and any(.scan.exiftool.fields,
(
.key == "CommandLineArguments"
and strings.ilike(.value, "*findstr*", "*sc $path*", "*Set-Content*")
)
)
)
)
)
Playground
Test against your own EMLs or sample data.