---
title: Suspicious PowerShell Execution via LNK File
id: 6b993f7a-1a2b-3c4d-5e6f-7a8b9c0d1e2f
description: Detects PowerShell execution initiated by LNK files, a common vector for APT37 and APT28 initial access.
status: stable
author: Security Arsenal
date: 2026/04/14
references:
    - https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html
    - https://thehackernews.com/2026/04/dprk-linked-hackers-use-github-as-c2-in.html
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\explorer.exe'
        CommandLine|contains: 'powershell.exe'
        ParentCommandLine|contains: '.lnk'
    condition: selection
falsepositives:
    - Legitimate system administration scripts
level: high
tags:
    - attack.execution
    - attack.initial_access
    - apt37
    - apt28
---
title: Non-Browser Process Connecting to GitHub
id: 8c0a1e2f-3b4d-5c6e-7f8a-9b0c1d2e3f4a
description: Detects non-browser processes connecting to GitHub domains, indicating potential C2 activity observed in DPRK campaigns.
status: stable
author: Security Arsenal
date: 2026/04/14
references:
    - https://thehackernews.com/2026/04/dprk-linked-hackers-use-github-as-c2-in.html
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'github.com'
            - 'api.github.com'
            - 'raw.githubusercontent.com'
    filter:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\edge.exe'
            - '\msedge.exe'
            - '\opera.exe'
            - '\git.exe'
            - '\githubdesktop.exe'
    condition: selection and not filter
falsepositives:
    - Developer tools using Git
level: medium
tags:
    - attack.command_and_control
    - apt37
---
title: PDF Reader Spawning Suspicious Child Process
id: 9d1b2f3a-4c5d-6e7f-8a9b-0c1d2e3f4a5b
description: Detects PDF readers spawning cmd, powershell, or wscript, associated with trojanized PDF app campaigns (RokRAT).
status: stable
author: Security Arsenal
date: 2026/04/14
references:
    - https://thehackernews.com/2026/04/north-koreas-apt37-uses-facebook-social.html
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|contains:
            - '\AcroRd32.exe'
            - '\FoxitPDFReader.exe'
            - '\pdfviewer.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate PDF form actions
level: high
tags:
    - attack.initial_access
    - attack.execution
    - rokrat

// Hunt for LNK files triggering PowerShell or suspicious network connections
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "explorer.exe" 
| where FileName in~("powershell.exe", "cmd.exe") 
| where InitiatingProcessCommandLine contains ".lnk"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| extend IoCLink = extract(@".*\\(.*\.lnk).*", 1, InitiatingProcessCommandLine)
| order by Timestamp desc

<#
.SYNOPSIS
    Hunt for indications of APT37/28 activity (LNK abuse, GitHub C2).
#>

Write-Host "[*] Checking for recent LNK files in User Downloads/AppData..." -ForegroundColor Cyan

$paths = @("$env:USERPROFILE\Downloads", "$env:APPDATA")
$recentFiles = Get-ChildItem -Path $paths -Filter *.lnk -Recurse -ErrorAction SilentlyContinue | 
               Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-3) }

if ($recentFiles) {
    Write-Host "[!] Found recent LNK files:" -ForegroundColor Yellow
    $recentFiles | Select-Object FullName, LastWriteTime
} else {
    Write-Host "[-] No recent LNK files found." -ForegroundColor Green
}

Write-Host "`n[*] Checking for non-standard processes connecting to GitHub..." -ForegroundColor Cyan

$githubProcs = Get-NetTCPConnection | 
               Where-Object { 
                   ($_.State -eq "Established") -and 
                   $_.RemoteAddress -ne "0.0.0.0" -and
                   (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction SilentlyContinue | 
                    Where-Object { $_.NameHost -like "*github*" })
               }

if ($githubProcs) {
    Write-Host "[!] Active GitHub connections found. Investigate PID:" -ForegroundColor Yellow
    $githubProcs | ForEach-Object { 
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc.ProcessName -notin @("chrome", "msedge", "firefox", "git", "GitHubDesktop")) {
            Write-Host "Process: $($proc.ProcessName) PID: $($proc.Id) Remote: $($_.RemoteAddress)"
        }
    }
} else {
    Write-Host "[-] No suspicious GitHub connections detected." -ForegroundColor Green
}


# Response Priorities

*   **Immediate (0–4 hours):**
    *   Block access to `zoho.com` and `github.com` for non-approved business accounts immediately.
    *   Isolate any endpoints identified in threat hunts with LNK-initiated PowerShell chains.
*   **Same-day (4–24 hours):**
    *   Conduct a sweep for the specific CVE-2026-21513 and CVE-2026-21509 exploitation attempts on perimeter logs.
    *   Review firewall/proxy logs for connections to Zoho WorkDrive or GitHub `raw` content repositories from internal hosts.
*   **This week:**
    *   Patch vulnerabilities CVE-2026-21513 and CVE-2026-21509 once vendor patches are available (or apply mitigations).
    *   Issue an internal security advisory warning users about "PDF Viewer" updates distributed via social media channels (Facebook/Telegram).