[Osquery_manager] LNK artifacts saved query #16059

tomsonpl · 2025-11-20T11:18:23Z

LNK File Forensics Artifact

The Windows LNK Shortcut File Forensics artifact provides comprehensive visibility into shortcut files across forensically significant locations, enabling detection of persistence mechanisms, malicious executables, and suspicious user activity. This query extracts full shortcut metadata enriched with hash values and authenticode signatures, with intelligent filtering for threat-relevant indicators.

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	LNK File Forensics	✅	Windows	lnk_forensics_windows_elastic	a1b2c3d4	Comprehensive Windows shortcut file forensics with suspicious pattern detection

Queries by Platform

🪟 Windows - LNK Shortcut File Forensics with Persistence & Threat Detection

Description

Comprehensive Windows LNK shortcut file forensics across all critical locations: user/system Startup folders (persistence), Desktop folders, Recent Items (user activity), Quick Launch, SendTo menu, and Start Menu Programs. Extracts full shortcut metadata (target path, target type, location, start_in, run mode, comment/arguments) enriched with hash values and authenticode signatures for both LNK files and their targets.

Detection Focus:

Startup Folder Persistence - LNK files in user and system-wide Startup folders for auto-execution
LOLBin Targeting - Shortcuts pointing to risky executables (cmd, powershell, pwsh, cscript, wscript, rundll32, regsvr32, mshta, wmic, certutil, bitsadmin)
Encoded Command Detection - Base64-encoded PowerShell commands, IEX patterns, download cradles
Suspicious Arguments - Hidden windows, download strings, Invoke-WebRequest, Invoke-Expression
Network Indicators - HTTP/HTTPS/FTP URLs in targets or arguments, UNC path references
Large LNK Files - Files >20KB that may contain embedded payloads or exploitation techniques
User Activity Tracking - Recent Items analysis for timeline reconstruction

MITRE ATT&CK Mapping:

Technique	Name	Tactic
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Persistence
T1204.002	User Execution: Malicious File	Execution
T1059.001	Command and Scripting Interpreter: PowerShell	Execution
T1059.003	Command and Scripting Interpreter: Windows Command Shell	Execution
T1021	Remote Services	Lateral Movement
T1105	Ingress Tool Transfer	Command and Control

Result

Query results include comprehensive LNK metadata with detection flags:

Full file path, timestamps (created, modified, accessed, changed)
Shortcut target path, type, location, start_in directory, run mode
Combined command line (target + arguments)
MD5, SHA1, SHA256 hashes of the LNK file
Authenticode signature details of the target executable
Detection flags: large_size_flag, startup_persistence_flag, risky_executable_flag, suspicious_arguments_flag, http_download_flag, unc_path_flag, large_arguments_flag

Platform

windows

Interval

3600 seconds (1 hour)

Query ID

lnk_forensics_windows_elastic

ECS Field Mappings

Event Fields:

event.category → ["file"] (static)
event.type → ["info"] (static)
event.module → osquery (static)
event.dataset → osquery.lnk_forensics (static)

Host Fields:

host.os.type → windows (static)

File Fields:

file.path → path
file.name → filename
file.directory → directory
file.size → size
file.created → created_time
file.mtime → modified_time
file.accessed → accessed_time
file.ctime → changed_time
file.extension → extension
file.hash.md5 → md5
file.hash.sha1 → sha1
file.hash.sha256 → sha256

Code Signature Fields:

file.code_signature.subject_name → signature_signer
file.code_signature.issuer → signature_issuer
file.code_signature.status → signature_status

Process Fields:

process.executable → shortcut_target_path
process.command_line → combined_command

Threat Intelligence Fields:

threat.framework → MITRE ATT&CK (static)
threat.tactic.id → ["TA0003", "TA0002", "TA0008", "TA0011"] (static)
threat.tactic.name → ["Persistence", "Execution", "Lateral Movement", "Command and Control"] (static)
threat.technique.id → ["T1547.001", "T1204.002", "T1059.001", "T1059.003", "T1021", "T1105"] (static)
threat.technique.name → ["Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder", "User Execution: Malicious File", "Command and Scripting Interpreter: PowerShell", "Command and Scripting Interpreter: Windows Command Shell", "Remote Services", "Ingress Tool Transfer"] (static)

Tags:

osquery, forensics, persistence, file-analysis, malware-detection, mitre_t1547_001, mitre_t1204_002, mitre_t1059_001, mitre_t1059_003, mitre_t1105, windows

SQL Query

-- Windows LNK Shortcut File Forensics with Suspicious Pattern Detection
-- Source: file table with native Windows shortcut parsing + authenticode signatures
-- Focus: Risky executables (LOLBins), malicious arguments, large files, persistence mechanisms
-- Scope: Comprehensive coverage of forensically significant LNK locations (startup, desktop, recent, quick launch, sendto, start menu)
-- Workaround: Uses path LIKE instead of directory = to ensure shortcut metadata is populated (osquery #8727)

WITH user_lnk_paths AS (
    -- Per-user LNK locations
    SELECT
        u.username,
        u.directory || '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' AS user_startup,
        u.directory || '\Desktop' AS user_desktop,
        u.directory || '\AppData\Roaming\Microsoft\Windows\Recent' AS user_recent,
        u.directory || '\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch' AS user_quicklaunch,
        u.directory || '\AppData\Roaming\Microsoft\Windows\SendTo' AS user_sendto,
        u.directory || '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs' AS user_startmenu
    FROM users u
    WHERE u.directory LIKE 'C:\Users\%'
      AND u.username NOT IN ('Default', 'Default User', 'Public', 'All Users')
),
lnk_files AS (
    -- User Startup folders (highest priority - persistence)
    -- Uses path LIKE instead of directory = to get shortcut metadata (osquery #8727 workaround)
    SELECT f.*, 'user_startup' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_startup || '\%.lnk'

    UNION ALL

    -- System-wide Startup folder (persistence)
    SELECT f.*, 'system_startup' AS location_type
    FROM file f
    WHERE f.path LIKE 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\%.lnk'

    UNION ALL

    -- User Desktop folders
    SELECT f.*, 'user_desktop' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_desktop || '\%.lnk'

    UNION ALL

    -- Public Desktop
    SELECT f.*, 'public_desktop' AS location_type
    FROM file f
    WHERE f.path LIKE 'C:\Users\Public\Desktop\%.lnk'

    UNION ALL

    -- Recent Items (user activity tracking)
    SELECT f.*, 'recent_items' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_recent || '\%.lnk'

    UNION ALL

    -- Quick Launch
    SELECT f.*, 'quick_launch' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_quicklaunch || '\%.lnk'

    UNION ALL

    -- SendTo menu
    SELECT f.*, 'sendto' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_sendto || '\%.lnk'

    UNION ALL

    -- Start Menu Programs (user)
    SELECT f.*, 'user_startmenu' AS location_type
    FROM user_lnk_paths p
    CROSS JOIN file f
    WHERE f.path LIKE p.user_startmenu || '\%.lnk'

    UNION ALL

    -- Start Menu Programs (system-wide)
    SELECT f.*, 'system_startmenu' AS location_type
    FROM file f
    WHERE f.path LIKE 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\%.lnk'
),
lnk_enriched AS (
    SELECT
        lnk.path,
        lnk.filename,
        lnk.directory,
        lnk.size,
        datetime(lnk.btime, 'unixepoch') AS created_time,
        datetime(lnk.mtime, 'unixepoch') AS modified_time,
        datetime(lnk.atime, 'unixepoch') AS accessed_time,
        datetime(lnk.ctime, 'unixepoch') AS changed_time,
        lnk.type,
        lnk.shortcut_target_path,
        lnk.shortcut_target_type,
        lnk.shortcut_target_location,
        lnk.shortcut_start_in,
        lnk.shortcut_run,
        lnk.shortcut_comment,
        lnk.location_type,
        'lnk' AS extension,
        CASE
            WHEN lnk.shortcut_target_path IS NOT NULL AND lnk.shortcut_comment IS NOT NULL
            THEN lnk.shortcut_target_path || ' ' || lnk.shortcut_comment
            WHEN lnk.shortcut_target_path IS NOT NULL
            THEN lnk.shortcut_target_path
            ELSE lnk.shortcut_comment
        END AS combined_command
    FROM lnk_files lnk
)
SELECT
    lnk.path,
    lnk.filename,
    lnk.directory,
    lnk.size,
    lnk.created_time,
    lnk.modified_time,
    lnk.accessed_time,
    lnk.changed_time,
    lnk.type,
    lnk.shortcut_target_path,
    lnk.shortcut_target_type,
    lnk.shortcut_target_location,
    lnk.shortcut_start_in,
    lnk.shortcut_run,
    lnk.shortcut_comment,
    lnk.combined_command,
    lnk.location_type,
    lnk.extension,
    h.md5,
    h.sha1,
    h.sha256,
    a.subject_name AS signature_signer,
    a.issuer_name AS signature_issuer,
    a.result AS signature_status,
    a.serial_number AS signature_serial,
    CASE WHEN lnk.size > 20000 THEN 1 ELSE 0 END AS large_size_flag,
    CASE WHEN lnk.location_type IN ('user_startup', 'system_startup') THEN 1 ELSE 0 END AS startup_persistence_flag,
    CASE
        WHEN lnk.shortcut_target_path LIKE '%\cmd.exe'
            OR lnk.shortcut_target_path LIKE '%\powershell.exe'
            OR lnk.shortcut_target_path LIKE '%\pwsh.exe'
            OR lnk.shortcut_target_path LIKE '%\cscript.exe'
            OR lnk.shortcut_target_path LIKE '%\wscript.exe'
            OR lnk.shortcut_target_path LIKE '%\rundll32.exe'
            OR lnk.shortcut_target_path LIKE '%\regsvr32.exe'
            OR lnk.shortcut_target_path LIKE '%\mshta.exe'
            OR lnk.shortcut_target_path LIKE '%\wmic.exe'
            OR lnk.shortcut_target_path LIKE '%\conhost.exe'
            OR lnk.shortcut_target_path LIKE '%\certutil.exe'
            OR lnk.shortcut_target_path LIKE '%\bitsadmin.exe'
        THEN 1 ELSE 0
    END AS risky_executable_flag,
    CASE
        WHEN lnk.combined_command LIKE '%\AppData\%'
            OR lnk.combined_command LIKE '%\Users\Public\%'
            OR lnk.combined_command LIKE '%\Temp\%'
            OR lnk.combined_command LIKE '%comspec%'
            OR lnk.combined_command LIKE '%&cd&echo%'
            OR lnk.combined_command LIKE '% -NoP %'
            OR lnk.combined_command LIKE '% -nop %'
            OR lnk.combined_command LIKE '% -W Hidden %'
            OR lnk.combined_command LIKE '% -w hidden %'
            OR lnk.combined_command LIKE '% -WindowStyle Hidden %'
            OR lnk.combined_command LIKE '% -decode %'
            OR lnk.combined_command LIKE '% /decode %'
            OR lnk.combined_command LIKE '% -e %JAB%'
            OR lnk.combined_command LIKE '% -e %SUVYI%'
            OR lnk.combined_command LIKE '% -e %SQBFAFgA%'
            OR lnk.combined_command LIKE '% -e %aWV4I%'
            OR lnk.combined_command LIKE '% -e %aQBlAHgA%'
            OR lnk.combined_command LIKE '% -enc %'
            OR lnk.combined_command LIKE '% -EncodedCommand %'
            OR lnk.combined_command LIKE '%start /b%'
            OR lnk.combined_command LIKE '%start \b%'
            OR lnk.combined_command LIKE '%.downloadstring(%'
            OR lnk.combined_command LIKE '%.downloadfile(%'
            OR lnk.combined_command LIKE '%Invoke-WebRequest%'
            OR lnk.combined_command LIKE '%iwr %'
            OR lnk.combined_command LIKE '%iex %'
            OR lnk.combined_command LIKE '%Invoke-Expression%'
        THEN 1 ELSE 0
    END AS suspicious_arguments_flag,
    CASE
        WHEN lnk.combined_command LIKE '%http://%'
            OR lnk.combined_command LIKE '%https://%'
            OR lnk.combined_command LIKE '%ftp://%'
            OR lnk.combined_command LIKE '%ftps://%'
        THEN 1 ELSE 0
    END AS http_download_flag,
    CASE
        WHEN lnk.combined_command LIKE '% \\%'
            OR lnk.shortcut_start_in LIKE '\\%'
        THEN 1 ELSE 0
    END AS unc_path_flag,
    CASE
        WHEN LENGTH(lnk.shortcut_comment) > 250
        THEN 1 ELSE 0
    END AS large_arguments_flag
FROM lnk_enriched lnk
LEFT JOIN hash h ON lnk.path = h.path
LEFT JOIN authenticode a ON a.path = lnk.shortcut_target_path
WHERE (
    -- Always include startup locations (persistence focus)
    lnk.location_type IN ('user_startup', 'system_startup')
    -- For other locations, filter for suspicious indicators
    OR lnk.size > 20000
    OR lnk.shortcut_target_path LIKE '%\cmd.exe'
    OR lnk.shortcut_target_path LIKE '%\powershell.exe'
    OR lnk.shortcut_target_path LIKE '%\pwsh.exe'
    OR lnk.shortcut_target_path LIKE '%\cscript.exe'
    OR lnk.shortcut_target_path LIKE '%\wscript.exe'
    OR lnk.shortcut_target_path LIKE '%\rundll32.exe'
    OR lnk.shortcut_target_path LIKE '%\regsvr32.exe'
    OR lnk.shortcut_target_path LIKE '%\mshta.exe'
    OR lnk.shortcut_target_path LIKE '%\wmic.exe'
    OR lnk.shortcut_target_path LIKE '%\conhost.exe'
    OR lnk.shortcut_target_path LIKE '%\certutil.exe'
    OR lnk.shortcut_target_path LIKE '%\bitsadmin.exe'
    OR lnk.combined_command LIKE '%\AppData\%'
    OR lnk.combined_command LIKE '%\Users\Public\%'
    OR lnk.combined_command LIKE '%\Temp\%'
    OR lnk.combined_command LIKE '%comspec%'
    OR lnk.combined_command LIKE '%&cd&echo%'
    OR lnk.combined_command LIKE '% -NoP %'
    OR lnk.combined_command LIKE '% -nop %'
    OR lnk.combined_command LIKE '% -W Hidden %'
    OR lnk.combined_command LIKE '% -w hidden %'
    OR lnk.combined_command LIKE '% -WindowStyle Hidden %'
    OR lnk.combined_command LIKE '% -decode %'
    OR lnk.combined_command LIKE '% /decode %'
    OR lnk.combined_command LIKE '% -e %JAB%'
    OR lnk.combined_command LIKE '% -e %SUVYI%'
    OR lnk.combined_command LIKE '% -e %SQBFAFgA%'
    OR lnk.combined_command LIKE '% -e %aWV4I%'
    OR lnk.combined_command LIKE '% -e %aQBlAHgA%'
    OR lnk.combined_command LIKE '% -enc %'
    OR lnk.combined_command LIKE '% -EncodedCommand %'
    OR lnk.combined_command LIKE '%start /b%'
    OR lnk.combined_command LIKE '%start \b%'
    OR lnk.combined_command LIKE '%.downloadstring(%'
    OR lnk.combined_command LIKE '%.downloadfile(%'
    OR lnk.combined_command LIKE '%Invoke-WebRequest%'
    OR lnk.combined_command LIKE '%iwr %'
    OR lnk.combined_command LIKE '%iex %'
    OR lnk.combined_command LIKE '%Invoke-Expression%'
    OR lnk.combined_command LIKE '%http://%'
    OR lnk.combined_command LIKE '%https://%'
    OR lnk.combined_command LIKE '%ftp://%'
    OR lnk.combined_command LIKE '%ftps://%'
    OR lnk.combined_command LIKE '% \\%'
    OR lnk.shortcut_start_in LIKE '\\%'
    OR LENGTH(lnk.shortcut_comment) > 250
)
-- Exclude common legitimate shortcuts (noise reduction)
AND lnk.filename NOT IN (
    'Excel.lnk', 'Word.lnk', 'PowerPoint.lnk', 'Outlook.lnk', 'OneNote.lnk',
    'Access.lnk', 'Publisher.lnk', 'Visio.lnk', 'Project.lnk', 'Teams.lnk',
    'Windows Media Player.lnk', 'Windows Explorer.lnk', 'Internet Explorer.lnk',
    'Microsoft Edge.lnk', 'Google Chrome.lnk', 'Firefox.lnk', 'Safari.lnk',
    'Notepad.lnk', 'Calculator.lnk', 'Paint.lnk', 'Snipping Tool.lnk',
    'Control Panel.lnk', 'Task Manager.lnk', 'File Explorer.lnk',
    'Visual Studio Code.lnk', 'Visual Studio.lnk', 'Slack.lnk', 'Zoom.lnk',
    'Adobe Acrobat.lnk', 'Adobe Reader.lnk', 'Spotify.lnk', 'Discord.lnk'
)
ORDER BY
    -- Priority: Startup locations first
    CASE WHEN lnk.location_type IN ('user_startup', 'system_startup') THEN 1 ELSE 2 END,
    -- Then by risky executable
    CASE
        WHEN lnk.shortcut_target_path LIKE '%\cmd.exe'
            OR lnk.shortcut_target_path LIKE '%\powershell.exe'
            OR lnk.shortcut_target_path LIKE '%\pwsh.exe'
            OR lnk.shortcut_target_path LIKE '%\cscript.exe'
            OR lnk.shortcut_target_path LIKE '%\wscript.exe'
            OR lnk.shortcut_target_path LIKE '%\rundll32.exe'
            OR lnk.shortcut_target_path LIKE '%\regsvr32.exe'
            OR lnk.shortcut_target_path LIKE '%\mshta.exe'
            OR lnk.shortcut_target_path LIKE '%\wmic.exe'
            OR lnk.shortcut_target_path LIKE '%\conhost.exe'
            OR lnk.shortcut_target_path LIKE '%\certutil.exe'
            OR lnk.shortcut_target_path LIKE '%\bitsadmin.exe'
        THEN 1 ELSE 2
    END,
    lnk.location_type,
    lnk.modified_time DESC;

raqueltabuyo · 2025-11-27T12:00:39Z

Verify if the folders for LNK files are only startup or Desktop, I believe you can store LNK files anywhere.

tomsonpl · 2025-11-28T18:24:50Z

I think there's a limitation or a BUG in osquery itself, created an issue: osquery/osquery#8725 let's see what they say :)

- Expand LNK file locations coverage with users table enumeration - Add cross-reference to YARA-based detection query - Document known limitation: shortcut_target_path may return empty - List affected ECS fields in description for transparency - Add SQL comments explaining limitation and workaround

- Add content-based detection scanning LNK binary for malicious patterns - Detect LOLBins: powershell, cmd, wscript, mshta, rundll32, certutil - Detect encoded commands, hidden execution, download cradles - Detect network indicators (http/https URLs) - Use CTE + JOIN pattern for YARA path constraints - Use scalar subqueries for hash enrichment (JOIN breaks YARA) - Bypasses osquery shortcut_target_path parsing limitation - Cross-reference to lnk_forensics_windows_elastic for enumeration

- Add lnk_yara_detection query (#28) to additional queries table - Update total query count from 31 to 32 - Update LNK files entry in User Activity section - Note YARA-based binary content scanning capability

ferullo

I see many columns returned in results from my host that are not mapped and do not have any values. What about pruning down the columns to just those being mapped or that you can provide screenshot data for to confirm what content will be in them?

ferullo · 2025-12-03T15:55:26Z

...manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json

+            {
+                "key": "file.created",
+                "value": {
+                    "field": "btime"


Can this be converted to a datetime string for usability/readability and because file.created is mapped as a datestring.

ferullo · 2025-12-03T15:55:36Z

...manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json

+            {
+                "key": "file.mtime",
+                "value": {
+                    "field": "mtime"


Same comment as btime

ferullo · 2025-12-03T15:55:46Z

...manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json

+            {
+                "key": "file.accessed",
+                "value": {
+                    "field": "atime"


Same comment as btime

ferullo · 2025-12-03T15:56:30Z

...manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json

+            {
+                "key": "file.ctime",
+                "value": {
+                    "field": "ctime"


Same comment as btime

ferullo · 2025-12-03T15:58:21Z

...manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json

+            {
+                "key": "file.type",
+                "value": {
+                    "field": "type"


This isn't what file.type is defined as. I only see regular in results from my results. What else are valid values? Maybe just don't map it?

ferullo · 2025-12-03T15:59:02Z

...manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json

+                "key": "file.hash.md5",
+                "value": {
+                    "field": "md5"
+                }
+            },
+            {
+                "key": "file.hash.sha1",
+                "value": {
+                    "field": "sha1"
+                }
+            },


In other queries sha1 is not returned. What do you think about standardizing which hashes are returned across all these queries. Perhaps just sha256?

After refactoring, all 3 hash fields should be available when possible. Do you think it's too much?

tomsonpl · 2025-12-05T14:35:37Z

Thanks for the review, this artifact will have to be done again. I used yara scanning here, because there is a bug in Osquery. Described here: osquery/osquery#8727 . However - we might get the proper results if I adjust the query a little bit and then we could get directly from lnk.

… ECS mappings - Apply path LIKE pattern instead of directory= to ensure shortcut metadata is populated - Add event.* ECS fields (category, type, module, dataset) - Add MITRE ATT&CK threat context fields (framework, tactic, technique) - Add human-readable datetime() formatting for timestamp columns - Fix column aliasing (authenticode_* → signature_*) for proper ECS mapping - Remove Shellbags cross-reference for cleaner query execution - Update coreMigrationVersion to 9.2.0

- Delete lnk_yara_detection_windows_elastic saved query - Update artifacts_matrix.md to remove YARA LNK references - Update query count from 32 to 31 - Consolidate LNK forensics to single comprehensive query

@ferullo

Address review feedback from @ferullo: osquery's file.type column returns 'regular' while ECS file.type expects 'file', causing semantic mismatch. Remove the mapping to maintain ECS compliance. The type column remains in query results for raw data visibility.

...manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json

calladoum-elastic

Minor change (remove the AND lnk.filename block) and LGTM

- Remove MITRE ATT&CK technique references from description - Remove threat.* ECS field mappings (framework, tactic, technique) - Remove mitre_attack metadata array with 6 technique entries - Change event.dataset to event.action for better alignment - Remove event.module and host.os.type field mappings - Simplify tags array to core categorization only

tomsonpl · 2026-01-02T09:56:35Z

I see many columns returned in results from my host that are not mapped and do not have any values. What about pruning down the columns to just those being mapped or that you can provide screenshot data for to confirm what content will be in them?

Hey, thanks for testing! I believe the empty columns you're seeing are context-dependent, not universally empty.
During my testing, all of the columns contained data, example screenshot - hope you can zoom in to see all of it. Any fields in particular that you suggest pruning?

- Add vt_link column for one-click VirusTotal hash reputation lookup - Remove filename exclusion filter (Excel.lnk, Word.lnk, etc.) to ensure complete forensic coverage - legitimate shortcuts can still be abused - Update timestamps to reflect modification date

ferullo · 2026-01-06T17:52:53Z

...manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json

+            {
+                "key": "process.command_line",
+                "value": {
+                    "field": "combined_command"


I saw some values like Displays the files and folders on your computer. for this field. Are you ok putting it in process.command_line? FWIW, I can't find a better field.

Good catch, if there was no path, then comment was used (alone). I haven't faced it, thanks for finding it!

👍 the times I saw this behavior it seemed like the link was a special behavior rather than a link to a path so I get why it would "overlap" with the command line. Again, I don't see an SQL or ECS issue with this, I just wanted to make sure you didn't either.

- fix process.command_line, preserve shortcut_comment via labels

…ct-lnk # Conflicts: # packages/osquery_manager/artifacts_matrix.md

elasticmachine · 2026-01-19T10:10:04Z

💚 Build Succeeded

Buildkite Build
Commit: d26440d

History

💚 Build #36186 succeeded d72e13c
💚 Build #36054 succeeded 011eb84
💚 Build #35945 succeeded bcb7fc5
💚 Build #35277 succeeded 7f18def
💚 Build #35270 succeeded b39c0ed
💚 Build #34423 succeeded 4bf83d1

tomsonpl added 2 commits November 20, 2025 12:12

lnk artifact

e79165c

fix

4bf83d1

tomsonpl marked this pull request as ready for review November 20, 2025 11:22

tomsonpl requested a review from a team as a code owner November 20, 2025 11:22

tomsonpl requested review from joeypoon and pzl and removed request for a team November 20, 2025 11:22

andrewkroh added Integration:osquery_manager Osquery Manager documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels Nov 20, 2025

tomsonpl changed the title ~~lnk artifact~~ [Osquery_manager] LNK artifacts saved query Nov 20, 2025

andrewkroh added the Team:Defend Workflows Security team for Endpoint and OSQuery workflows [elastic/security-defend-workflows] label Nov 25, 2025

tomsonpl added 3 commits November 28, 2025 19:53

docs(osquery_manager): update artifacts matrix with LNK queries

b39c0ed

- Add lnk_yara_detection query (#28) to additional queries table - Update total query count from 31 to 32 - Update LNK files entry in User Activity section - Note YARA-based binary content scanning capability

ferullo reviewed Dec 3, 2025

View reviewed changes

tomsonpl marked this pull request as draft December 5, 2025 14:35

tomsonpl requested review from pzl and removed request for joeypoon and pzl December 8, 2025 14:25

tomsonpl added 3 commits December 9, 2025 11:56

Remove YARA-based LNK detection query

f9d9e66

- Delete lnk_yara_detection_windows_elastic saved query - Update artifacts_matrix.md to remove YARA LNK references - Update query count from 32 to 31 - Consolidate LNK forensics to single comprehensive query

tomsonpl marked this pull request as ready for review December 9, 2025 11:12

tomsonpl requested a review from calladoum-elastic December 9, 2025 11:12

calladoum-elastic reviewed Dec 9, 2025

View reviewed changes

...manager/kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json Outdated Show resolved Hide resolved

calladoum-elastic requested changes Dec 10, 2025

View reviewed changes

calladoum-elastic mentioned this pull request Dec 10, 2025

[Osquery_manager] WMI artifacts saved query #16227

Merged

ferullo reviewed Jan 6, 2026

View reviewed changes

Fix command_line

d72e13c

- fix process.command_line, preserve shortcut_comment via labels

ferullo approved these changes Jan 12, 2026

View reviewed changes

calladoum-elastic approved these changes Jan 14, 2026

View reviewed changes

tomsonpl added 2 commits January 19, 2026 10:39

Merge branch 'temporary-osquery-artifacts-branch' into osquery-artifa…

9804777

…ct-lnk # Conflicts: # packages/osquery_manager/artifacts_matrix.md

update matrix

d26440d

tomsonpl merged commit ff60357 into temporary-osquery-artifacts-branch Jan 19, 2026
8 checks passed

tomsonpl deleted the osquery-artifact-lnk branch January 19, 2026 10:12

[Osquery_manager] LNK artifacts saved query #16059

[Osquery_manager] LNK artifacts saved query #16059

Uh oh!

Conversation

tomsonpl commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LNK File Forensics Artifact

Core Forensic Artifacts Coverage

Queries by Platform

Description

Result

Platform

Interval

Query ID

ECS Field Mappings

SQL Query

Uh oh!

raqueltabuyo commented Nov 27, 2025

Uh oh!

tomsonpl commented Nov 28, 2025

Uh oh!

ferullo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomsonpl commented Dec 5, 2025

Uh oh!

Uh oh!

calladoum-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

tomsonpl commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jan 19, 2026

💚 Build Succeeded

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

tomsonpl commented Nov 20, 2025 •

edited

Loading

tomsonpl commented Jan 2, 2026 •

edited

Loading