[Osquery_manager] LNK artifacts saved query

[tomsonpl]

LNK File Forensics Artifact

The Windows LNK Shortcut File Forensics artifact provides comprehensive visibility into shortcut files across forensically significant locations, enabling detection of persistence mechanisms, malicious executables, and suspicious user activity. This query extracts full shortcut metadata enriched with hash values and authenticode signatures, with intelligent filtering for threat-relevant indicators.

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	LNK File Forensics	✅	Windows	lnk_forensics_windows_elastic	a1b2c3d4	Comprehensive Windows shortcut file forensics with suspicious pattern detection

Queries by Platform

---

🪟 Windows - LNK Shortcut File Forensics with Persistence & Threat Detection

Description

Comprehensive Windows LNK shortcut file forensics across all critical locations: user/system Startup folders (persistence), Desktop folders, Recent Items (user activity), Quick Launch, SendTo menu, and Start Menu Programs. Extracts full shortcut metadata (target path, target type, location, start_in, run mode, comment/arguments) enriched with hash values and authenticode signatures for both LNK files and their targets.

Detection Focus:

• Startup Folder Persistence - LNK files in user and system-wide Startup folders for auto-execution
• LOLBin Targeting - Shortcuts pointing to risky executables (cmd, powershell, pwsh, cscript, wscript, rundll32, regsvr32, mshta, wmic, certutil, bitsadmin)
• Encoded Command Detection - Base64-encoded PowerShell commands, IEX patterns, download cradles
• Suspicious Arguments - Hidden windows, download strings, Invoke-WebRequest, Invoke-Expression
• Network Indicators - HTTP/HTTPS/FTP URLs in targets or arguments, UNC path references
• Large LNK Files - Files >20KB that may contain embedded payloads or exploitation techniques
• User Activity Tracking - Recent Items analysis for timeline reconstruction

MITRE ATT&CK Mapping:

Technique	Name	Tactic
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Persistence
T1204.002	User Execution: Malicious File	Execution
T1059.001	Command and Scripting Interpreter: PowerShell	Execution
T1059.003	Command and Scripting Interpreter: Windows Command Shell	Execution
T1021	Remote Services	Lateral Movement
T1105	Ingress Tool Transfer	Command and Control

Result

Query results include comprehensive LNK metadata with detection flags:

• Full file path, timestamps (created, modified, accessed, changed)
• Shortcut target path, type, location, start_in directory, run mode
• Combined command line (target + arguments)
• MD5, SHA1, SHA256 hashes of the LNK file
• Authenticode signature details of the target executable
• Detection flags: large_size_flag, startup_persistence_flag, risky_executable_flag, suspicious_arguments_flag, http_download_flag, unc_path_flag, large_arguments_flag

Platform

windows

Interval

3600 seconds (1 hour)

Query ID

lnk_forensics_windows_elastic

ECS Field Mappings

Event Fields:

• event.category → ["file"] (static)
• event.type → ["info"] (static)
• event.module → osquery (static)
• event.dataset → osquery.lnk_forensics (static)

Host Fields:

• host.os.type → windows (static)

File Fields:

• file.path → path
• file.name → filename
• file.directory → directory
• file.size → size
• file.created → created_time
• file.mtime → modified_time
• file.accessed → accessed_time
• file.ctime → changed_time
• file.extension → extension
• file.hash.md5 → md5
• file.hash.sha1 → sha1
• file.hash.sha256 → sha256

Code Signature Fields:

• file.code_signature.subject_name → signature_signer
• file.code_signature.issuer → signature_issuer
• file.code_signature.status → signature_status

Process Fields:

• process.executable → shortcut_target_path
• process.command_line → combined_command

Threat Intelligence Fields:

• threat.framework → MITRE ATT&CK (static)
• threat.tactic.id → ["TA0003", "TA0002", "TA0008", "TA0011"] (static)
• threat.tactic.name → ["Persistence", "Execution", "Lateral Movement", "Command and Control"] (static)
• threat.technique.id → ["T1547.001", "T1204.002", "T1059.001", "T1059.003", "T1021", "T1105"] (static)
• threat.technique.name → ["Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder", "User Execution: Malicious File", "Command and Scripting Interpreter: PowerShell", "Command and Scripting Interpreter: Windows Command Shell", "Remote Services", "Ingress Tool Transfer"] (static)

Tags:

• osquery, forensics, persistence, file-analysis, malware-detection, mitre_t1547_001, mitre_t1204_002, mitre_t1059_001, mitre_t1059_003, mitre_t1105, windows

SQL Query

-- Windows LNK Shortcut File Forensics with Suspicious Pattern Detection
-- Source: file table with native Windows shortcut parsing + authenticode signatures
-- Focus: Risky executables (LOLBins), malicious arguments, large files, persistence mechanisms
-- Scope: Comprehensive coverage of forensically significant LNK locations (startup, desktop, recent, quick launch, sendto, start menu)
-- Workaround: Uses path LIKE instead of directory = to ensure shortcut metadata is populated (osquery #8727)

WITH user_lnk_paths AS (
    -- Per-user LNK locations
    SELECT
        u.username,
        u.directory || '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' AS user_startup,
        u.directory || '\Desktop' AS user_desktop,
        u.directory || '\AppData\Roaming\Microsoft\Windows\Recent' AS user_recent,
        u.directory || '\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch' AS user_quicklaunch,
        u.directory || '\AppData\Roaming\Microsoft\Windows\SendTo' AS user_sendto,
        u.directory || '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs' AS user_startmenu
    FROM users u
    WHERE u.directory LIKE 'C:\Users\%'
      AND u.username NOT IN ('Default', 'Default User', 'Public', 'All Users')
),
lnk_files AS (
    -- User Startup folders (highest priority - persistence)
    -- Uses path LIKE instead of directory = to get shortcut metadata (osquery #8727 workaround)
    SELECT f.*, 'user_startup' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_startup || '\%.lnk'

    UNION ALL

    -- System-wide Startup folder (persistence)
    SELECT f.*, 'system_startup' AS location_type
    FROM file f
    WHERE f.path LIKE 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\%.lnk'

    UNION ALL

    -- User Desktop folders
    SELECT f.*, 'user_desktop' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_desktop || '\%.lnk'

    UNION ALL

    -- Public Desktop
    SELECT f.*, 'public_desktop' AS location_type
    FROM file f
    WHERE f.path LIKE 'C:\Users\Public\Desktop\%.lnk'

    UNION ALL

    -- Recent Items (user activity tracking)
    SELECT f.*, 'recent_items' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_recent || '\%.lnk'

    UNION ALL

    -- Quick Launch
    SELECT f.*, 'quick_launch' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_quicklaunch || '\%.lnk'

    UNION ALL

    -- SendTo menu
    SELECT f.*, 'sendto' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_sendto || '\%.lnk'

    UNION ALL

    -- Start Menu Programs (user)
    SELECT f.*, 'user_startmenu' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_startmenu || '\%.lnk'

    UNION ALL

    -- Start Menu Programs (system-wide)
    SELECT f.*, 'system_startmenu' AS location_type
    FROM file f
    WHERE f.path LIKE 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\%.lnk'
),
lnk_enriched AS (
    SELECT
        lnk.path,
        lnk.filename,
        lnk.directory,
        lnk.size,
        datetime(lnk.btime, 'unixepoch') AS created_time,
        datetime(lnk.mtime, 'unixepoch') AS modified_time,
        datetime(lnk.atime, 'unixepoch') AS accessed_time,
        datetime(lnk.ctime, 'unixepoch') AS changed_time,
        lnk.type,
        lnk.shortcut_target_path,
        lnk.shortcut_target_type,
        lnk.shortcut_target_location,
        lnk.shortcut_start_in,
        lnk.shortcut_run,
        lnk.shortcut_comment,
        lnk.location_type,
        'lnk' AS extension,
        CASE
            WHEN lnk.shortcut_target_path IS NOT NULL AND lnk.shortcut_comment IS NOT NULL
            THEN lnk.shortcut_target_path || ' ' || lnk.shortcut_comment
            WHEN lnk.shortcut_target_path IS NOT NULL
            THEN lnk.shortcut_target_path
            ELSE lnk.shortcut_comment
        END AS combined_command
    FROM lnk_files lnk
)
SELECT
    lnk.path,
    lnk.filename,
    lnk.directory,
    lnk.size,
    lnk.created_time,
    lnk.modified_time,
    lnk.accessed_time,
    lnk.changed_time,
    lnk.type,
    lnk.shortcut_target_path,
    lnk.shortcut_target_type,
    lnk.shortcut_target_location,
    lnk.shortcut_start_in,
    lnk.shortcut_run,
    lnk.shortcut_comment,
    lnk.combined_command,
    lnk.location_type,
    lnk.extension,
    h.md5,
    h.sha1,
    h.sha256,
    a.subject_name AS signature_signer,
    a.issuer_name AS signature_issuer,
    a.result AS signature_status,
    a.serial_number AS signature_serial,
    CASE WHEN lnk.size > 20000 THEN 1 ELSE 0 END AS large_size_flag,
    CASE WHEN lnk.location_type IN ('user_startup', 'system_startup') THEN 1 ELSE 0 END AS startup_persistence_flag,
    CASE
        WHEN lnk.shortcut_target_path LIKE '%\cmd.exe'
            OR lnk.shortcut_target_path LIKE '%\powershell.exe'
            OR lnk.shortcut_target_path LIKE '%\pwsh.exe'
            OR lnk.shortcut_target_path LIKE '%\cscript.exe'
            OR lnk.shortcut_target_path LIKE '%\wscript.exe'
            OR lnk.shortcut_target_path LIKE '%\rundll32.exe'
            OR lnk.shortcut_target_path LIKE '%\regsvr32.exe'
            OR lnk.shortcut_target_path LIKE '%\mshta.exe'
            OR lnk.shortcut_target_path LIKE '%\wmic.exe'
            OR lnk.shortcut_target_path LIKE '%\conhost.exe'
            OR lnk.shortcut_target_path LIKE '%\certutil.exe'
            OR lnk.shortcut_target_path LIKE '%\bitsadmin.exe'
        THEN 1 ELSE 0
    END AS risky_executable_flag,
    CASE
        WHEN lnk.combined_command LIKE '%\AppData\%'
            OR lnk.combined_command LIKE '%\Users\Public\%'
            OR lnk.combined_command LIKE '%\Temp\%'
            OR lnk.combined_command LIKE '%comspec%'
            OR lnk.combined_command LIKE '%&cd&echo%'
            OR lnk.combined_command LIKE '% -NoP %'
            OR lnk.combined_command LIKE '% -nop %'
            OR lnk.combined_command LIKE '% -W Hidden %'
            OR lnk.combined_command LIKE '% -w hidden %'
            OR lnk.combined_command LIKE '% -WindowStyle Hidden %'
            OR lnk.combined_command LIKE '% -decode %'
            OR lnk.combined_command LIKE '% /decode %'
            OR lnk.combined_command LIKE '% -e %JAB%'
            OR lnk.combined_command LIKE '% -e %SUVYI%'
            OR lnk.combined_command LIKE '% -e %SQBFAFgA%'
            OR lnk.combined_command LIKE '% -e %aWV4I%'
            OR lnk.combined_command LIKE '% -e %aQBlAHgA%'
            OR lnk.combined_command LIKE '% -enc %'
            OR lnk.combined_command LIKE '% -EncodedCommand %'
            OR lnk.combined_command LIKE '%start /b%'
            OR lnk.combined_command LIKE '%start \b%'
            OR lnk.combined_command LIKE '%.downloadstring(%'
            OR lnk.combined_command LIKE '%.downloadfile(%'
            OR lnk.combined_command LIKE '%Invoke-WebRequest%'
            OR lnk.combined_command LIKE '%iwr %'
            OR lnk.combined_command LIKE '%iex %'
            OR lnk.combined_command LIKE '%Invoke-Expression%'
        THEN 1 ELSE 0
    END AS suspicious_arguments_flag,
    CASE
        WHEN lnk.combined_command LIKE '%http://%'
            OR lnk.combined_command LIKE '%https://%'
            OR lnk.combined_command LIKE '%ftp://%'
            OR lnk.combined_command LIKE '%ftps://%'
        THEN 1 ELSE 0
    END AS http_download_flag,
    CASE
        WHEN lnk.combined_command LIKE '% \\%'
            OR lnk.shortcut_start_in LIKE '\\%'
        THEN 1 ELSE 0
    END AS unc_path_flag,
    CASE
        WHEN LENGTH(lnk.shortcut_comment) > 250
        THEN 1 ELSE 0
    END AS large_arguments_flag
FROM lnk_enriched lnk
LEFT JOIN hash h ON lnk.path = h.path
LEFT JOIN authenticode a ON a.path = lnk.shortcut_target_path
WHERE (
    -- Always include startup locations (persistence focus)
    lnk.location_type IN ('user_startup', 'system_startup')
    -- For other locations, filter for suspicious indicators
    OR lnk.size > 20000
    OR lnk.shortcut_target_path LIKE '%\cmd.exe'
    OR lnk.shortcut_target_path LIKE '%\powershell.exe'
    OR lnk.shortcut_target_path LIKE '%\pwsh.exe'
    OR lnk.shortcut_target_path LIKE '%\cscript.exe'
    OR lnk.shortcut_target_path LIKE '%\wscript.exe'
    OR lnk.shortcut_target_path LIKE '%\rundll32.exe'
    OR lnk.shortcut_target_path LIKE '%\regsvr32.exe'
    OR lnk.shortcut_target_path LIKE '%\mshta.exe'
    OR lnk.shortcut_target_path LIKE '%\wmic.exe'
    OR lnk.shortcut_target_path LIKE '%\conhost.exe'
    OR lnk.shortcut_target_path LIKE '%\certutil.exe'
    OR lnk.shortcut_target_path LIKE '%\bitsadmin.exe'
    OR lnk.combined_command LIKE '%\AppData\%'
    OR lnk.combined_command LIKE '%\Users\Public\%'
    OR lnk.combined_command LIKE '%\Temp\%'
    OR lnk.combined_command LIKE '%comspec%'
    OR lnk.combined_command LIKE '%&cd&echo%'
    OR lnk.combined_command LIKE '% -NoP %'
    OR lnk.combined_command LIKE '% -nop %'
    OR lnk.combined_command LIKE '% -W Hidden %'
    OR lnk.combined_command LIKE '% -w hidden %'
    OR lnk.combined_command LIKE '% -WindowStyle Hidden %'
    OR lnk.combined_command LIKE '% -decode %'
    OR lnk.combined_command LIKE '% /decode %'
    OR lnk.combined_command LIKE '% -e %JAB%'
    OR lnk.combined_command LIKE '% -e %SUVYI%'
    OR lnk.combined_command LIKE '% -e %SQBFAFgA%'
    OR lnk.combined_command LIKE '% -e %aWV4I%'
    OR lnk.combined_command LIKE '% -e %aQBlAHgA%'
    OR lnk.combined_command LIKE '% -enc %'
    OR lnk.combined_command LIKE '% -EncodedCommand %'
    OR lnk.combined_command LIKE '%start /b%'
    OR lnk.combined_command LIKE '%start \b%'
    OR lnk.combined_command LIKE '%.downloadstring(%'
    OR lnk.combined_command LIKE '%.downloadfile(%'
    OR lnk.combined_command LIKE '%Invoke-WebRequest%'
    OR lnk.combined_command LIKE '%iwr %'
    OR lnk.combined_command LIKE '%iex %'
    OR lnk.combined_command LIKE '%Invoke-Expression%'
    OR lnk.combined_command LIKE '%http://%'
    OR lnk.combined_command LIKE '%https://%'
    OR lnk.combined_command LIKE '%ftp://%'
    OR lnk.combined_command LIKE '%ftps://%'
    OR lnk.combined_command LIKE '% \\%'
    OR lnk.shortcut_start_in LIKE '\\%'
    OR LENGTH(lnk.shortcut_comment) > 250
)
-- Exclude common legitimate shortcuts (noise reduction)
AND lnk.filename NOT IN (
    'Excel.lnk', 'Word.lnk', 'PowerPoint.lnk', 'Outlook.lnk', 'OneNote.lnk',
    'Access.lnk', 'Publisher.lnk', 'Visio.lnk', 'Project.lnk', 'Teams.lnk',
    'Windows Media Player.lnk', 'Windows Explorer.lnk', 'Internet Explorer.lnk',
    'Microsoft Edge.lnk', 'Google Chrome.lnk', 'Firefox.lnk', 'Safari.lnk',
    'Notepad.lnk', 'Calculator.lnk', 'Paint.lnk', 'Snipping Tool.lnk',
    'Control Panel.lnk', 'Task Manager.lnk', 'File Explorer.lnk',
    'Visual Studio Code.lnk', 'Visual Studio.lnk', 'Slack.lnk', 'Zoom.lnk',
    'Adobe Acrobat.lnk', 'Adobe Reader.lnk', 'Spotify.lnk', 'Discord.lnk'
)
ORDER BY
    -- Priority: Startup locations first
    CASE WHEN lnk.location_type IN ('user_startup', 'system_startup') THEN 1 ELSE 2 END,
    -- Then by risky executable
    CASE
        WHEN lnk.shortcut_target_path LIKE '%\cmd.exe'
            OR lnk.shortcut_target_path LIKE '%\powershell.exe'
            OR lnk.shortcut_target_path LIKE '%\pwsh.exe'
            OR lnk.shortcut_target_path LIKE '%\cscript.exe'
            OR lnk.shortcut_target_path LIKE '%\wscript.exe'
            OR lnk.shortcut_target_path LIKE '%\rundll32.exe'
            OR lnk.shortcut_target_path LIKE '%\regsvr32.exe'
            OR lnk.shortcut_target_path LIKE '%\mshta.exe'
            OR lnk.shortcut_target_path LIKE '%\wmic.exe'
            OR lnk.shortcut_target_path LIKE '%\conhost.exe'
            OR lnk.shortcut_target_path LIKE '%\certutil.exe'
            OR lnk.shortcut_target_path LIKE '%\bitsadmin.exe'
        THEN 1 ELSE 2
    END,
    lnk.location_type,
    lnk.modified_time DESC;

[raqueltabuyo]

Verify if the folders for LNK files are only startup or Desktop, I believe you can store LNK files anywhere.

[tomsonpl]

I think there's a limitation or a BUG in osquery itself, created an issue: osquery/osquery#8725 let's see what they say :)

[ferullo]

I see many columns returned in results from my host that are not mapped and do not have any values. What about pruning down the columns to just those being mapped or that you can provide screenshot data for to confirm what content will be in them?

[ferullo]

Can this be converted to a datetime string for usability/readability and because file.created is mapped as a datestring.

[ferullo]

Same comment as btime

[ferullo]

Same comment as btime

[ferullo]

Same comment as btime

[ferullo]

This isn't what file.type is defined as. I only see regular in results from my results. What else are valid values? Maybe just don't map it?

[ferullo]

In other queries sha1 is not returned. What do you think about standardizing which hashes are returned across all these queries. Perhaps just sha256?

[tomsonpl]

After refactoring, all 3 hash fields should be available when possible. Do you think it's too much?

[tomsonpl]

Thanks for the review, this artifact will have to be done again. I used yara scanning here, because there is a bug in Osquery. Described here: osquery/osquery#8727 . However - we might get the proper results if I adjust the query a little bit and then we could get directly from lnk.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 7f18def

History

• 💚 Build #35270 succeeded b39c0ed
• 💚 Build #34423 succeeded 4bf83d1

[calladoum-elastic]

The block

-- Exclude common legitimate shortcuts (noise reduction)
AND lnk.filename NOT IN (
    'Excel.lnk', 'Word.lnk', 'PowerPoint.lnk', 'Outlook.lnk', 'OneNote.lnk',
    'Access.lnk', 'Publisher.lnk', 'Visio.lnk', 'Project.lnk', 'Teams.lnk',
    'Windows Media Player.lnk', 'Windows Explorer.lnk', 'Internet Explorer.lnk',
    'Microsoft Edge.lnk', 'Google Chrome.lnk', 'Firefox.lnk', 'Safari.lnk',
    'Notepad.lnk', 'Calculator.lnk', 'Paint.lnk', 'Snipping Tool.lnk',
    'Control Panel.lnk', 'Task Manager.lnk', 'File Explorer.lnk',
    'Visual Studio Code.lnk', 'Visual Studio.lnk', 'Slack.lnk', 'Zoom.lnk',
    'Adobe Acrobat.lnk', 'Adobe Reader.lnk', 'Spotify.lnk', 'Discord.lnk'
)

would skip reporting LNK files with a target path that would point to cmd.exe / powershell.exe / mshta.exe / etc.

This is effectively allowing attackers to hide malicious LNKs since there is no reason for any item in that list to execute cmd.exe for instance. Should we consider removing this block?

[calladoum-elastic]

Minor change (remove the AND lnk.filename block) and LGTM