Detect Microsoft Windows Link Following Vulnerability (CVE-2025-60710) in Splunk
CVE-2025-60710 is an actively exploited Microsoft Windows link following vulnerability (CWE-59) that allows an attacker to abuse symbolic links or junction points to redirect file operations to unintended locations. This class of vulnerability is commonly leveraged for privilege escalation, file tampering, or unauthorized access to protected resources. The vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild exploitation.
MITRE ATT&CK
SPL Detection Query
index=windows (source="WinEventLog:Security" OR source="WinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval event_id=coalesce(EventCode, event_id)
| where event_id IN ("4656", "4663", "4670", "1", "11")
| eval cmdline=coalesce(CommandLine, ProcessCommandLine, "")
| eval file_path=coalesce(TargetFilename, ObjectName, "")
| where match(cmdline, "(?i)(mklink|junction|CreateSymbolicLink|NtSetInformationFile)")
OR (match(file_path, "(?i)(\\\\Temp\\\\|\\\\AppData\\\\Local\\\\Temp\\\\.+\\.lnk$|\\\\Windows\\\\Temp\\\\)"))
| where NOT match(User, "(?i)(SYSTEM|NT AUTHORITY)")
| stats count AS event_count, values(cmdline) AS commands, values(file_path) AS paths, dc(host) AS host_count BY User, host, _time
| where event_count > 1
| sort - event_countDetects symbolic link and junction creation events via Sysmon and Windows Security logs for CVE-2025-60710. Looks for mklink, junction, and related API calls in temporary paths by non-system users.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Software package managers (npm, pip, conda) creating symlinks for module resolution
- CI/CD pipeline agents running as non-system users performing build artifact linking
- Legitimate administrative scripts using mklink for storage management
Other platforms for CVE-2025-60710
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Symbolic Link in Temp Directory Targeting Privileged Path
Expected signal: Sysmon Event ID 1 capturing mklink.exe execution with command line containing the symlink and target paths; Sysmon Event ID 11 showing creation of test_link.txt in C:\Windows\Temp\.
- Test 2Junction Point Creation Targeting System32
Expected signal: Sysmon Event ID 1 with mklink /J command line and junction target; Windows Security Event ID 4663 on subsequent directory traversal through the junction.
- Test 3PowerShell Symbolic Link Creation via .NET API
Expected signal: Sysmon Event ID 1 showing powershell.exe with CreateSymbolicLink in command line; Sysmon Event ID 11 or 12 for the created link object in Temp directory.
Response Playbook
Triage
- Identify the process that created the symbolic link or junction: record the full command line, parent process, and executing user account.
- Determine the source and target of the link — assess whether the target path is a privileged system location (e.g., System32, Program Files, SAM hive, sensitive registry exports).
- Review the process tree for the suspicious process to identify whether exploitation led to subsequent high-privilege child processes (e.g., cmd.exe or powershell.exe spawned by a SYSTEM-level service).
- Check Windows Event ID 4672 (Special Logon) and 4688 (Process Creation) on the affected host within the same time window to detect privilege escalation outcomes.
- Correlate the host's patch level against Microsoft's CVE-2025-60710 advisory to confirm exploitability.
Containment
- Isolate the affected endpoint from the network using EDR quarantine or network ACL to prevent lateral movement or data exfiltration while investigation continues.
- Terminate any suspicious processes identified in triage and remove the malicious symbolic link or junction point to stop ongoing exploitation.
Evidence Collection
- Collect the full process creation logs (Sysmon Event ID 1, Windows Event ID 4688) and file system event logs (Sysmon Event ID 11) from the affected host for the 30-minute window surrounding the alert.
- Preserve a forensic image or memory dump of the affected system, particularly capturing the contents of the Temp directory, any .lnk files, and the security event log prior to remediation.
Escalation Criteria
- !Escalate immediately if the symbolic link target resolves to a privileged system path (e.g., SAM, SYSTEM hive, LSASS process memory, or a domain controller SYSVOL share).
- !Escalate if the exploiting process subsequently spawns a shell or executes additional payloads under SYSTEM or Administrator context, indicating successful privilege escalation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Prefetch files for mklink.exe or any custom dropper — located at C:\Windows\Prefetch\. - >
MFT (Master File Table) entries for newly created .lnk files or junction points in Temp directories, recoverable via tools like MFTECmd. - >
Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) logs capturing the link creation timeline. - >
Windows Security Event ID 4663 (Object Access) showing access attempts on the link target path under SYSTEM context.
Tuning Guidance
Reduce false positives by building an allowlist of known software installers and developer tools (e.g., npm, Visual Studio, SCCM client) that legitimately create symlinks or junctions. Scope the detection to non-interactive service accounts and filter on parent processes commonly associated with user-initiated exploitation (e.g., browser child processes, Office child processes, or processes spawned from user Temp directories). Consider raising confidence to high when the symlink target resolves to a sensitive path such as System32, SAM, or LSASS.
Hunting Queries
Threat hunt for all symbolic link and .lnk file creation activity in temporary paths by non-system accounts across the environment, useful for identifying broader exploitation campaigns leveraging CVE-2025-60710.
DeviceFileEvents
| where ActionType == "SymlinkCreated" or (FileName endswith ".lnk" and FolderPath has "\\Temp\\")
| where InitiatingProcessAccountName !in~ ("SYSTEM", "NT AUTHORITY")
| summarize count() by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, bin(TimeGenerated, 1h)
| order by count_ descindex=windows source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| rex field=TargetFilename "(?P<dir>.+\\\\)(?P<fname>[^\\\\]+$)"
| where match(TargetFilename, "(?i)(\\.lnk$|\\\\Temp\\\\|\\\\AppData\\\\)")
| where NOT match(User, "(?i)(SYSTEM|NT AUTHORITY)")
| stats count AS link_events, values(TargetFilename) AS linked_paths BY host, User, Image
| sort - link_eventsAtomic Red Team Tests
Simulates CVE-2025-60710 exploitation by creating a symbolic link in a writable temp directory pointing to a privileged system file, then attempting a file read through the link.
Command
cmd.exe /c mklink C:\Windows\Temp\test_link.txt C:\Windows\System32\drivers\etc\hosts && type C:\Windows\Temp\test_link.txtCleanup
cmd.exe /c del C:\Windows\Temp\test_link.txtExpected Telemetry
Sysmon Event ID 1 capturing mklink.exe execution with command line containing the symlink and target paths; Sysmon Event ID 11 showing creation of test_link.txt in C:\Windows\Temp\.
Expected Detection
Alert fires on symbolic link creation in Temp directory by non-SYSTEM user with command line matching mklink pattern.
Creates a directory junction point from a user-writable path to C:\Windows\System32, simulating the file redirection primitive in link following attacks.
Command
cmd.exe /c mklink /J C:\Users\Public\sys32_junction C:\Windows\System32 && dir C:\Users\Public\sys32_junctionCleanup
cmd.exe /c rmdir C:\Users\Public\sys32_junctionExpected Telemetry
Sysmon Event ID 1 with mklink /J command line and junction target; Windows Security Event ID 4663 on subsequent directory traversal through the junction.
Expected Detection
Detection triggers on junction creation command (mklink /J) by a non-privileged user account targeting a system path.
Uses PowerShell to invoke the .NET System.IO API to create a symbolic link, bypassing direct mklink invocation and testing API-level detection coverage.
Command
powershell.exe -Command "[System.IO.Directory]::CreateSymbolicLink('C:\Windows\Temp\ps_link', 'C:\Windows\System32\winevt\Logs')"Cleanup
powershell.exe -Command "Remove-Item C:\Windows\Temp\ps_link -Force -ErrorAction SilentlyContinue"Expected Telemetry
Sysmon Event ID 1 showing powershell.exe with CreateSymbolicLink in command line; Sysmon Event ID 11 or 12 for the created link object in Temp directory.
Expected Detection
Detection fires on PowerShell process with CreateSymbolicLink in command line creating a link in a Temp path, correlated with file creation event.