LNK | Netskope Threat Labs

Description

This generic detection identifies malicious Windows shortcut (LNK) files used to execute malware.

Alert Name	Engine
Document-Word.Trojan.Lnk	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.Lnk	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.Lnk	ATP Sandbox Adv. Heuristics
Trojan.Lnk.EX	AV
Trojan.Lnk.FB	AV
Trojan.Lnk.FD	AV
Worm.Lnk.C	AV

Signature Name	Engine
FILE-IDENTIFY LNK file download request	IPS-SWG
INDICATOR-OBFUSCATION LNK file with obfuscated PowerShell commands download attempt	IPS-CFWIPS-SWG
MALWARE-CNC Lnk.Dropper.Gamaredon malicious download attempt	IPS-SWG
MALWARE-OTHER Lnk.Trojan.Gamaredon variant download attempt	IPS-SWG
OS-WINDOWS LNK file NTLM spoofing attempt	IPS-CFWIPS-SWG