Yara: lnk_encoded_powershell

rule lnk_encoded_powershell
{
    meta:
        description = "LNK with encoded PowerShell"
        author = "daniel gallagher"
        date = "2017-07"
        filetype = "lnk"

	strings:
		$s1 = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" ascii nocase
		$s2 = "-ExecutionPolicy bypass" wide nocase
		$s3 = "-windowstyle hidden" wide nocase
		$s4 = "-encodedcommand" wide nocase

	condition:
        (
        uint32be(0) == 0x4C000000 and uint32be(4) == 0x01140200
        )
        and filesize < 12KB
		    and all of ($s*)
}