HUNTING MALICIOUS SHORTCUT (.LNK) FILES USING THE VIRUSTOTAL API

Summary from the TLDR InfoSec newsletter

Attackers frequently utilize shortcut files as an initial access vector, as they can obscure malicious commands from a user. In this post, the author compiled a corpus of 614 malicious LNK files using the VirusTotal API and employed frequency analysis to extract common command-line arguments from malicious shortcuts that execute PowerShell or CMD. The author then utilized KQL to construct threat hunting queries that search for malicious LNK files using this corpus of data.