Sigma rule: Suspicious LNK Command-Line Padding with Whitespace Characters

Rule

Title

Suspicious LNK Command-Line Padding with Whitespace Characters

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-03-19

File

rules/windows/process_creation/proc_creation_win_susp_lnk_exec_hidden_cmd.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D).
Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.
The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.
This rule flags suspicious use of such padding observed in real-world attacks.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - ParentImage|endswith: '\explorer.exe'
    - ParentCommandLine|contains: '.lnk'
selection_cmd:
    - CommandLine|contains:
          - '                 '  # Padding of SPACE (0x20)
        # - '	'  # Horizontal Tab (0x9)
          - '\u0009'
          - '\u000A' # Line Feed
          - '\u0011'
          - '\u0012'
          - '\u0013'
          - '\u000B' # Vertical Tab
          - '\u000C'  # \x0C
          - '\u000D'  # \x0D
    - CommandLine|re: '\n\n\n\n\n\n' # In some cases \u000[ABCD] are represented as a newline in the eventlog
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.execution
• attack.t1204.002

MITRE ATT&CK ids this rule names

• T1204.002

References

• https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415
• https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html
• https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_lnk_exec_hidden_cmd.yml