Shortcut or search-connector file dropped in a user-facing folder

Siemphony@siemphonylowT1187unverifiedPlaybook · Credential theft

AN0065 is a four-step chain — a lure is staged, a user or the shell renders it, the host authenticates outbound over SMB or WebDAV, and the attempts repeat — and only the first step has a log source in this brief, so this rule takes the staging leg and nothing else. It matches file types Explorer parses on sight rather than on open, which is what makes them useful as forced-authentication lures: a UNC reference inside the file is resolved while the folder is merely being listed, and the credential leak happens before the user has clicked anything. That also bounds what a match means. The outbound NTLM leg, and the untrusted-destination test that would make it interesting, need network telemetry the brief does not list, so a hit here is a file worth reading, not evidence that a hash left the host. The extension set is MITRE's LureExtensions knob and the path set its UserLocations knob, both populated here with authored values: .scf is the historical form of this lure and .url, .library-ms and .searchConnector-ms the ones seen more recently. Written in the Sysmon EventID 11 vocabulary, so the field is TargetFilename; the brief also maps Security EventID 4663 onto this same file_event category, but 4663 carries ObjectName and ProcessName instead, so pointing this rule at a SACL-audited 4663 feed needs a field mapping first and enabling Audit File System on its own will not make it match. EventID 11 must also not be filtered for these paths, which stock Sysmon configurations frequently do. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0022, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Shortcut or search-connector file dropped in a user-facing folder2id: 4f248e09-b311-4f6b-a239-24a79116b0b33status: experimental4description: |5  AN0065 is a four-step chain — a lure is staged, a user or the shell renders it,6  the host authenticates outbound over SMB or WebDAV, and the attempts repeat —7  and only the first step has a log source in this brief, so this rule takes the8  staging leg and nothing else. It matches file types Explorer parses on sight9  rather than on open, which is what makes them useful as forced-authentication10  lures: a UNC reference inside the file is resolved while the folder is merely11  being listed, and the credential leak happens before the user has clicked12  anything. That also bounds what a match means. The outbound NTLM leg, and the13  untrusted-destination test that would make it interesting, need network14  telemetry the brief does not list, so a hit here is a file worth reading, not15  evidence that a hash left the host. The extension set is MITRE's LureExtensions16  knob and the path set its UserLocations knob, both populated here with authored17  values: .scf is the historical form of this lure and .url, .library-ms and18  .searchConnector-ms the ones seen more recently. Written in the Sysmon19  EventID 11 vocabulary, so the field is TargetFilename; the brief also maps20  Security EventID 4663 onto this same file_event category, but 4663 carries21  ObjectName and ProcessName instead, so pointing this rule at a SACL-audited22  4663 feed needs a field mapping first and enabling Audit File System on its23  own will not make it match. EventID 11 must also not be filtered for these24  paths, which stock Sysmon configurations frequently do.25  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0022, not hand-written and not tested by its author. Any lab result is on this rule's own page.26references:27  - https://attack.mitre.org/techniques/T118728  - https://attack.mitre.org/detectionstrategies/DET002229author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)30date: 2026-08-1631tags:32  - attack.credential-access33  - attack.t118734logsource:35  category: file_event36  product: windows37detection:38  selection_lure:39    TargetFilename|endswith:40      - '.scf'41      - '.url'42      - '.library-ms'43      - '.searchConnector-ms'44  selection_location:45    TargetFilename|contains:46      - '\Desktop\'47      - '\Downloads\'48      - '\Users\Public\'49      - '\Start Menu\'50      - '\Templates\'51      - '\AppData\Local\Temp\'52  condition: selection_lure and selection_location53falsepositives:54  - "Users dragging a hyperlink onto the Desktop or saving a link from a browser, which writes a .url file into exactly these folders under the user's own account and is the highest-volume benign match of the four extensions by a wide margin."55  - "Application installers and update packages dropping a support or product .url shortcut into the Start Menu program folder or onto the Desktop, which recurs across every host in a software deployment wave."56  - "Federated search and library rollouts, where a sanctioned intranet, SharePoint or file-server connector registers a .searchConnector-ms or .library-ms file under each user's profile — one legitimate change produces one match per user."57  - "Archive handling, since extracting or previewing a downloaded .zip through Explorer materialises its members under AppData\\Local\\Temp and a shortcut inside an ordinary archive lands there with no user intent behind it."58level: low

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where ((FolderPath endswith ".scf" or FolderPath endswith ".url" or FolderPath endswith ".library-ms" or FolderPath endswith ".searchConnector-ms") and (FolderPath contains "\\Desktop\\" or FolderPath contains "\\Downloads\\" or FolderPath contains "\\Users\\Public\\" or FolderPath contains "\\Start Menu\\" or FolderPath contains "\\Templates\\" or FolderPath contains "\\AppData\\Local\\Temp\\"))

Splunk · SPL

Run this as a search.

index=* ((TargetFilename="*.scf" OR TargetFilename="*.url" OR TargetFilename="*.library-ms" OR TargetFilename="*.searchConnector-ms") AND (TargetFilename="*\\Desktop\\*" OR TargetFilename="*\\Downloads\\*" OR TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\Start Menu\\*" OR TargetFilename="*\\Templates\\*" OR TargetFilename="*\\AppData\\Local\\Temp\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(file.path) LIKE "*.scf" OR TO_LOWER(file.path) LIKE "*.url" OR TO_LOWER(file.path) LIKE "*.library-ms" OR TO_LOWER(file.path) LIKE "*.searchconnector-ms") AND (TO_LOWER(file.path) LIKE "*\\\\desktop\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\downloads\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\users\\\\public\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\start menu\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\templates\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\local\\\\temp\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(\.scf$|\.url$|\.library-ms$|\.searchConnector-ms$)</field>    <field name="TargetFilename" type="pcre2">(?i)(\\Desktop\\|\\Downloads\\|\\Users\\Public\\|\\Start Menu\\|\\Templates\\|\\AppData\\Local\\Temp\\)</field>    <description>Shortcut or search-connector file dropped in a user-facing folder</description>    <mitre>      <id>T1187</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: low
Category: kerberos_ticket_abuse
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 4f248e09-b311-4f6b-a239-24a79116b0b3

ATT&CKT1187

T1187Forced Authentication

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1187, evaluated against their file_event events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Suppress by writing process rather than by removing extensions: .url files written by browsers and by your deployment agent account for most of the volume and are identifiable in EventID 11. Trim UserLocations to your actual profile layout. If you add .lnk, expect the volume to rise sharply and pair it with a process filter from the start. Drop \Templates\ unless you also add the Office template extensions.

Declared by the author

Users dragging a hyperlink onto the Desktop or saving a link from a browser, which writes a .url file into exactly these folders under the user's own account and is the highest-volume benign match of the four extensions by a wide margin.
Application installers and update packages dropping a support or product .url shortcut into the Start Menu program folder or onto the Desktop, which recurs across every host in a software deployment wave.
Federated search and library rollouts, where a sanctioned intranet, SharePoint or file-server connector registers a .searchConnector-ms or .library-ms file under each user's profile — one legitimate change produces one match per user.
Archive handling, since extracting or previewing a downloaded .zip through Explorer materialises its members under AppData\Local\Temp and a shortcut inside an ordinary archive lands there with no user intent behind it.

Lessonkerberos ticket abuse

kerberos ticket abuseAI draft — unreviewed

01 · What this rule detects

The staging leg of a forced-authentication lure, and only that. AN0065 is a four-step chain: a lure file is written, Explorer or a user renders it, the host authenticates outbound over SMB or WebDAV, and the attempts repeat. Only step one has a log source in this brief. So the rule matches a shortcut or search-connector file appearing in a folder users browse — file types Explorer parses on sight rather than on open, which is what makes them useful lures. A hit is a file worth reading. It is not evidence that a hash left the host.

02 · Telemetry you need

Sysmon EventID 11, mapped to file_event / windows, copied verbatim from the brief. The rule is written in the Sysmon vocabulary, so the field is TargetFilename. The brief also maps Security EventID 4663 onto this same file_event category, but 4663 carries ObjectName and ProcessName instead — pointing this rule at a SACL-audited 4663 feed needs a field mapping first, and enabling Audit File System alone will not make it match. Stock Sysmon configurations frequently exclude these paths from EventID 11; check yours.

03 · How the logic works

Two selections, ANDed. selection_lure tests TargetFilename|endswith against .scf, .url, .library-ms, .searchConnector-ms. selection_location tests TargetFilename|contains against \Desktop\, \Downloads\, \Users\Public\, \Start Menu\, \Templates\, \AppData\Local\Temp\. MITRE names these knobs LureExtensions and UserLocations; the specific extensions and paths written here are the pipeline's own selections from those categories. Three limits matter more than the logic does. First, the UNC reference inside the file — the only thing that makes it a T1187 lure rather than an ordinary shortcut — lives in file content, which file_event cannot see. The rule therefore overlaps with sibling rules already published under T1080, T1189, T1547.009, T1566.001 and T1566.003, all of which fire on the same event. Second, review flagged that MITRE lists .lnk first under LureExtensions and this rule omits it without a word, even though .lnk is the lure that still works. Third, .scf — the rule's headline extension — has been inert since the 2018 Explorer patch, and \Templates\ is effectively dead because Office template extensions are not in the list.

04 · Common false positives

Dominantly: a user dragging a hyperlink to the Desktop or saving a link from a browser writes a .url into exactly these folders. That single benign pattern outvolumes the other three extensions by a wide margin, which is why the rule ships at level: low. Installers drop product .url shortcuts into Start Menu folders across an entire deployment wave. A sanctioned SharePoint or file-server connector rollout registers one .searchConnector-ms per user. Extracting a .zip through Explorer materialises members under AppData\Local\Temp with no user intent behind it.

05 · Detection maturity

tier_1: Lowest tier. Never executed against a log line. Both the extension set and the path set are authored guesses, one branch is probably dead and another is probably obsolete. It advances only after a real EventID 11 feed shows what actually lands in these folders in your estate.

Share this rule

/u/siemphony/4f248e09-b311-4f6b-a239-24a79116b0b3

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Shortcut or search-connector file dropped in a user-facing folder

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it