SUSP_LNK_Follina_Jun22

Rule Info

Tags
['SUSP', 'DEMO', 'T1023', 'FILE', 'CVE_2022_30190', 'T1210']
Description
Detects LNK files with suspicious Follina / CVE-2022-30190 strings
Required Modules
[]
Date
2022-06-02
Score
75
Author
Paul Hager
Name
SUSP_LNK_Follina_Jun22
Rule Hash
4185f9d4af993b73a4cf905a71719db7
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
1
Clean (0 engines)
0

Rule Matches

Total
Positives
Timestamp
Hash
VT
60
3
2022-08-24 14:15:39
76f8d59fe20575082ea7404561378eb7d6e508df5937bf5ccd5eea75acf52464

Rule Matches per Month (last 24 months)