Hunt Playbook: APT LNK Delivery and Post-Exploitation Surveillance Framework Detection

State-sponsored threat groups — particularly IRGC-affiliated APT42 (Charming Kitten) — have been actively targeting professionals in the nuclear energy sector, defence, and policy research using LNK files disguised as PDF documents. The final payload is a modular surveillance and collection framework with capabilities spanning process enumeration, command execution, browser credential harvesting, Outlook mailbox collection, screenshot capture, and multi-channel C2. DarkAtlas documented confirmed targeting through at least May 2026.

This playbook covers the full kill chain from LNK delivery to post-exploitation collection, with Sigma rules and KQL queries at each stage.

Stage 1: LNK Initial Access — Spear-Phishing via Podcast or Interview Invitation

What happens: The victim receives a targeted email — typically a podcast invitation, expert panel request, or media interview offer — that contains a LNK file with a PDF-mimicking icon. When the user double-clicks what appears to be a document, Windows executes the LNK’s target command: typically a PowerShell or cmd invocation that drops and runs the initial stager.

Why it works: LNK files render without a file extension in many email clients and Windows Explorer views. The icon is set to the system PDF icon. The victim believes they are opening a PDF document.

Detection: LNK execution spawning PowerShell with encoded command

title: LNK File Spawning Encoded PowerShell Stager
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects Windows Shell spawning PowerShell with Base64-encoded command after LNK execution, consistent with spear-phishing LNK delivery
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
      - '-e '
    CommandLine|contains:
      - '.lnk'
  filter_legitimate:
    CommandLine|contains: 'WindowsPowerShell\Modules'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate admin scripts launched from LNK shortcuts
level: high
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.execution
  - attack.t1059.001

KQL (Sentinel / Microsoft 365 Defender)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe"
| where InitiatingProcessFileName in~ ("explorer.exe", "cmd.exe")
| where ProcessCommandLine has_any ("-EncodedCommand", "-enc ", "-e ")
| where InitiatingProcessCommandLine has ".lnk"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Stage 2: Discovery and System Enumeration

What happens: Once the initial stager executes, TAMECAT-style frameworks enumerate the victim system before staging additional modules. Common enumeration: systeminfo, whoami /all, net user, net group, ipconfig /all, tasklist, directory listings of %USERPROFILE% and %APPDATA%.

Detection: Rapid system enumeration from unusual parent process

title: Rapid Host Enumeration Sequence from Suspicious Parent
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
status: experimental
description: Detects burst of Windows system enumeration commands spawned by a non-standard parent process, consistent with post-exploitation discovery phase
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'systeminfo'
      - 'whoami /all'
      - 'net user'
      - 'net group'
      - 'ipconfig /all'
      - 'tasklist'
    ParentImage|contains:
      - '\powershell.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  timeframe: 5m
  condition: selection | count() by ParentProcessId > 4
falsepositives:
  - IT management scripts running legitimate inventory
level: medium
tags:
  - attack.discovery
  - attack.t1082
  - attack.t1033

Stage 3: Browser Credential Harvesting (T1555.003)

What happens: The framework targets Chromium-based browsers (Chrome, Edge, Brave) and Firefox for saved credentials. Chromium stores credentials in an SQLite database at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data. The file is locked while the browser is open, but attackers either copy it while closed or use the Windows Volume Shadow Copy service to access it.

Detection: Suspicious access to browser credential database

title: Abnormal Process Reading Browser Credential Database
id: c3d4e5f6-a7b8-9012-cdef-345678901234
status: experimental
description: Detects non-browser processes accessing Chrome or Edge Login Data SQLite database, indicative of credential harvesting
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Microsoft\Edge\User Data\Default\Login Data'
      - '\BraveSoftware\Brave-Browser\User Data\Default\Login Data'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\MicrosoftEdgeUpdate.exe'
  condition: selection and not filter_browsers
falsepositives:
  - Endpoint security tools performing credential scanning
  - Backup software
level: high
tags:
  - attack.credential_access
  - attack.t1555.003

KQL

DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any (
    @"Google\Chrome\User Data\Default\Login Data",
    @"Microsoft\Edge\User Data\Default\Login Data",
    @"BraveSoftware\Brave-Browser\User Data\Default\Login Data"
)
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "brave.exe", "MicrosoftEdgeUpdate.exe")
| project Timestamp, DeviceName, AccountName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine

Stage 4: Outlook .ost Mailbox Exfiltration (T1114.001)

What happens: TAMECAT specifically targets Outlook Offline Storage (.ost) files — the local copy of the Exchange mailbox. The file is typically at %LOCALAPPDATA%\Microsoft\Outlook\*.ost. The attacker copies it using a staging tool or compresses it with Windows built-in utilities before exfiltration. An .ost file from a senior researcher or policy expert may contain years of sensitive communications.

Detection: Non-Outlook process reading .ost file

title: Non-Outlook Process Accessing Outlook OST Mailbox File
id: d4e5f6a7-b8c9-0123-defa-456789012345
status: experimental
description: Detects processes other than Outlook and its helper processes accessing .ost mailbox files, indicating potential email data collection
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|endswith: '.ost'
    TargetFilename|contains: '\Microsoft\Outlook\'
  filter_outlook:
    Image|endswith:
      - '\OUTLOOK.EXE'
      - '\OfficeClickToRun.exe'
      - '\OfficeC2RClient.exe'
      - '\SearchIndexer.exe'
  condition: selection and not filter_outlook
falsepositives:
  - Third-party backup software accessing Outlook data
  - Migration tools
level: high
tags:
  - attack.collection
  - attack.t1114.001

Stage 5: Screenshot Capture (T1113)

What happens: The framework captures screenshots at intervals using Windows GDI APIs (BitBlt, CreateCompatibleBitmap) from a process that typically has no reason to interact with the screen. The resulting images are staged in a temp directory before exfiltration.

Detection: Unusual process using GDI screen capture APIs

title: Non-GUI Process Loading gdi32.dll for Screen Capture
id: e5f6a7b8-c9d0-1234-efab-567890123456
status: experimental
description: Detects console or background processes loading GDI libraries commonly used for screen capture, consistent with surveillance framework screenshot functionality
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith:
      - '\gdi32.dll'
      - '\gdi32full.dll'
    Image|endswith:
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection
falsepositives:
  - Some PowerShell scripts that interact with Windows GUI components
level: medium
tags:
  - attack.collection
  - attack.t1113

Stage 6: Staging and Exfiltration

What happens: Collected data (credentials, .ost file, screenshots) is staged — often as a password-protected ZIP archive — then exfiltrated over HTTPS to a C2 server or to a cloud storage endpoint used as a dead-drop. The fallback C2 mechanism may use DNS tunneling or a legitimate service (OneDrive, Google Drive) to relay data.

KQL — Detect staging archives written to temp locations by suspicious parents

DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName endswith ".zip" or FileName endswith ".7z" or FileName endswith ".rar"
| where FolderPath has_any (@"\Temp\", @"\AppData\Local\Temp\", @"\AppData\Roaming\")
| where InitiatingProcessFileName in~ ("powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "cmd.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine

Hunting Pivots

If any of the above rules fire, pivot on:

• Process tree: trace the parent chain back to the LNK or email attachment that started the execution
• Network connections: query all outbound HTTPS connections from the suspicious process within the same time window — look for connections to domains registered within the past 90 days
• Lateral movement: check for WMI, SMB, or RPC activity from the host within 24 hours of the initial LNK execution
• Other hosts: if this is a spear-phishing campaign, look for the same LNK file hash or similar PowerShell encoded command patterns across the fleet

Coverage Summary