YARA · SecuInfra Falcon Team

SECUINFRA_SUSP_LNK_Staging_Directory

Detects typical staging directories being referenced inside lnk files

What this rule detects

Detects typical staging directories being referenced inside lnk files

It defines 2 patterns (1 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Author: SECUINFRA Falcon Team

Source repository: SecuInfra Falcon Team @ 2d7c66d7d1

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 459ed2e6-133c-5cde-bf49-95bf8a5eb8c8

Tags:FILE

SECUINFRA_OBFUS_Powershell_ExecutionMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_OBFUS_Powershell_Replace_TildeMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02
SECUINFRA_OBFUS_VBS_Reverse_StartupMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Discord_Attachments_URLMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
SECUINFRA_SUSP_Netsh_Firewall_CommandMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
SECUINFRA_SUSP_Powershell_Download_Temp_RundllMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Metadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
SECUINFRA_SUSP_Reverse_Run_KeyMetadata only
Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27