lnk

The lnk module parses Windows Link files (.lnk), and exposes metadata contained in those files to YARA.

Module structure#

ShellItem#

These are the fields in each entry of the target_id_list array. Each entry corresponds to an ItemID within the LinkTargetIDList structure defined in the Microsoft [MS-SHLLINK] specification (section 2.2). The internal layout of each shell item is not specified by Microsoft; the type-specific fields below follow the reverse-engineered Windows Shell Item format documentation. Which fields are populated depends on the shell item type (item_type); the raw data field is always populated, so rules can match on shell item types that are not decoded into a dedicated field. The fields are listed in order of the item_type they belong to.

Example#

import "lnk"

rule lnk_suspicious_cpl_target {
    condition:
        for any item in lnk.target_id_list : (
            item.item_type == lnk.ShellItemType.CONTROL_PANEL_CPL and
            item.cpl_file_path endswith ".dll"
        )
}

ShellItemType#

These are the possible values for the item_type field of a ShellItem. The values are the class type indicators from the Windows Shell Item format; for the volume, file entry and network location items (whose class type indicator is a range) the value is the base of the range.

TrackerData#

These are the fields in the tracker_data structure, which contains data that can be used to resolve a link target if it is not found in its original location when the link is resolved. This data is passed to the Link Tracking service [MS-DLTW] to find the link target.

Example#

import "lnk"

rule lnk_cdrom {
    condition:
        lnk.tracker_data.machine_id == "chris-xps"
}

DriveType#

These are the possible values for the drive_type field.

Example#

import "lnk"

rule lnk_cdrom {
    condition:
        lnk.drive_type == lnk.DriveType.CDROM 
}

FileAttributes#

ShowCommand#

These are the possible values for the show_command field.

Example#

import "lnk"

rule lnk_maximized {
    condition:
        lnk.show_command == lnk.ShowCommand.MAXIMIZED
}