Microsoft Windows Link Following Vulnerability (CVE-2025-60710)

let suspiciousSymlinkOps = DeviceFileEvents
| where ActionType in ("SymlinkCreated", "JunctionCreated", "FileCreated", "FileModified")
| where FileName endswith ".lnk" or FolderPath has_any ("\\Temp\\", "\\AppData\\Local\\Temp\\", "\\Windows\\Temp\\")
| project TimeGenerated, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType;
let privEscIndicators = DeviceProcessEvents
| where ProcessCommandLine has_any ("mklink", "CreateSymbolicLink", "junction", "NtSetInformationFile")
| where AccountName != "SYSTEM" or InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
suspiciousSymlinkOps
| join kind=inner privEscIndicators on DeviceId
| where abs(datetime_diff('second', TimeGenerated, TimeGenerated1)) < 60
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FolderPath, FileName, ActionType
| order by TimeGenerated desc

index=windows (source="WinEventLog:Security" OR source="WinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval event_id=coalesce(EventCode, event_id)
| where event_id IN ("4656", "4663", "4670", "1", "11")
| eval cmdline=coalesce(CommandLine, ProcessCommandLine, "")
| eval file_path=coalesce(TargetFilename, ObjectName, "")
| where match(cmdline, "(?i)(mklink|junction|CreateSymbolicLink|NtSetInformationFile)")
   OR (match(file_path, "(?i)(\\\\Temp\\\\|\\\\AppData\\\\Local\\\\Temp\\\\.+\\.lnk$|\\\\Windows\\\\Temp\\\\)"))
| where NOT match(User, "(?i)(SYSTEM|NT AUTHORITY)")
| stats count AS event_count, values(cmdline) AS commands, values(file_path) AS paths, dc(host) AS host_count BY User, host, _time
| where event_count > 1
| sort - event_count

sequence by host.id with maxspan=2m
  [process where event.type == "start"
   and process.command_line like~ ("*mklink*", "*junction*", "*CreateSymbolicLink*")
   and not user.name in ("SYSTEM", "NT AUTHORITY\\SYSTEM")]
  [file where event.action in ("creation", "modification")
   and (
     file.path like~ "*\\Temp\\*"
     or file.path like~ "*\\AppData\\Local\\Temp\\*"
     or file.extension == "lnk"
   )
   and not user.name in ("SYSTEM", "NT AUTHORITY\\SYSTEM")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  QIDNAME(qid) AS event_name,
  "Process CommandLine" AS cmdline,
  "File Path" AS file_path,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (LOWER("Process CommandLine") ILIKE '%mklink%'
    OR LOWER("Process CommandLine") ILIKE '%junction%'
    OR LOWER("Process CommandLine") ILIKE '%createsymboliclink%')
  AND LOWER(username) NOT IN ('system', 'nt authority\\system', 'local service', 'network service')
  AND (LOWER("File Path") ILIKE '%\\temp\\%'
    OR LOWER("File Path") ILIKE '%appdata%local%temp%'
    OR LOWER("File Path") ILIKE '%.lnk')
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| json auto
| where (CommandLine matches "*mklink*" or CommandLine matches "*junction*" or CommandLine matches "*CreateSymbolicLink*")
  or (TargetFilename matches "*\\Temp\\*" and TargetFilename matches "*.lnk")
| where !(User matches "SYSTEM" or User matches "NT AUTHORITY*")
| count by _sourceHost, User, CommandLine, TargetFilename
| where _count > 0
| order by _count desc

rule cve_2025_60710_link_following {
  meta:
    author = "df00tech"
    description = "Detects Windows link following exploitation activity associated with CVE-2025-60710"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.hostname = $host
    $proc.principal.user.userid != /(?i)(system|nt authority)/
    (
      re.regex($proc.target.process.command_line, `(?i)(mklink|junction|CreateSymbolicLink)`)
    )
    $file.metadata.event_type = "FILE_CREATION"
    $file.principal.hostname = $host
    (
      re.regex($file.target.file.full_path, `(?i)(\\Temp\\|AppData\\Local\\Temp\\|.+\.lnk$)`)
    )

  match:
    $host over 2m

  condition:
    $proc and $file
}

#event_simpleName=ProcessRollup2
| CommandLine = /(?i)(mklink|junction|CreateSymbolicLink|NtSetInformationFile)/
| UserName != /(?i)(SYSTEM|NT AUTHORITY)/
| join type=inner (
    #event_simpleName IN ("FileOpenInfo", "NewExecutableWritten")
    | FilePath = /(?i)(\\Temp\\|\\AppData\\Local\\Temp\\|\.lnk$)/
  ) [ComputerName, aid] start=-2m end=now
| table([@timestamp, ComputerName, UserName, CommandLine, FilePath, ParentBaseFileName])
| sort(@timestamp, order=desc)