Phorpiex Botnet Campaign: Detecting LNK-Based Delivery of Global Group Ransomware

---
title: Suspicious LNK File Spawning PowerShell
description: Detects when a Windows Shortcut (.lnk) file spawns a PowerShell process, a common TTP for Phorpiex delivery vectors involving social engineering.
id: 88c345a1-1a2b-4c3d-9e0f-1a2b3c4d5e6f
status: experimental
references:
 - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2025/04/06
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      '-NoP'
      '-W Hidden'
  condition: selection
falsepositives:
  - Legitimate administrative scripts triggered by shortcuts (rare)
level: high
---
title: CMD Spawning PowerShell via LNK
description: Detects cmd.exe spawning PowerShell with encoded commands, typical of Phorpiex LNK execution chains.
id: 99d456b2-2b3c-5d4e-0f1a-2b3c4d5e6f70
status: experimental
references:
 - https://attack.mitre.org/techniques/T1059/003/
author: Security Arsenal
date: 2025/04/06
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\cmd.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      'FromBase64String'
      'DownloadString'
  condition: selection
falsepositives:
  - System administration automation
level: high

// Hunt for LNK files initiating suspicious PowerShell processes
let suspiciousProcesses = DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "cmd.exe")
| where ProcessCommandLine has_any ("-NoP", "-W Hidden", "-enc", "DownloadString")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath;
// Correlate with file creation events for LNK extensions
let lnkCreation = DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName endswith ".lnk"
| project Timestamp, DeviceName, FileName, FolderPath;
suspiciousProcesses
| join kind=inner (lnkCreation) on DeviceName, Timestamp
| where Timestamp <= ago(1m) // Correlation window

-- Hunt for recently modified LNK files in user directories
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs="\\Users\\*\\Downloads\\*.lnk")
WHERE Mtime < now() AND Mtime > -2h

-- Hunt for PowerShell processes spawned by Explorer (LNK trigger)
SELECT Pid, Name, CommandLine, Parent.Pid, Parent.Name
FROM pslist()
WHERE Name =~ "powershell.exe"
  AND Parent.Name =~ "explorer.exe"
  AND CommandLine =~ "-NoP|Hidden|DownloadString"

# Phorpiex Remediation & LNK Hardening Script
# Requires Administrator Privileges

Write-Host "[*] Initiating Phorpiex/Global Group Threat Hunt and Containment..." -ForegroundColor Cyan

# 1. Kill suspicious PowerShell processes spawned by Explorer
Write-Host "[+] Terminating suspicious PowerShell instances..." -ForegroundColor Yellow
Get-Process | Where-Object { 
    $_.ProcessName -eq "powershell" -and 
    $_.Parent.ProcessName -eq "explorer" -and 
    $_.CommandLine -match "-NoP|-W Hidden|DownloadString"
} | Stop-Process -Force -ErrorAction SilentlyContinue

# 2. Scan User Downloads and Temp for recent LNK files
Write-Host "[+] Scanning for recent malicious LNK files..." -ForegroundColor Yellow
$startTime = (Get-Date).AddHours(-24)
$paths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:APPDATA\Local\Temp")

$maliciousLnks = @()
foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Filter *.lnk -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt $startTime } | 
        ForEach-Object {
            $maliciousLnks += $_.FullName
            Remove-Item $_.FullName -Force -ErrorAction SilentlyContinue
            Write-Host "[-] Removed suspicious LNK: $($_.FullName)" -ForegroundColor Red
        }
    }
}

if ($maliciousLnks.Count -eq 0) {
    Write-Host "[INFO] No recent LNK files found in standard directories." -ForegroundColor Green
}

# 3. Enable Macro/Powershell Hardening (If not already enforced)
Write-Host "[*] Verifying Script Execution Policy..." -ForegroundColor Yellow
$currentPolicy = Get-ExecutionPolicy
if ($currentPolicy -ne "Restricted" -and $currentPolicy -ne "Undefined") {
    Write-Host "[!] Warning: Execution Policy is currently set to $currentPolicy. Consider tightening for end-users." -ForegroundColor DarkYellow
}

Write-Host "[*] Remediation Complete. Please perform a full AV/EDR scan." -ForegroundColor Green