Microsoft XDR (Defender) - DeviceEvents - ShellLinkCreateFileEvent

Question

Microsoft XDR (Defender) - DeviceEvents - ShellLinkCreateFileEvent

viri4to 10

Hi everyone,

I've been trying to create a hunting query in the Defender portal to identify when a malicious .lnk file is created. I noticed that an interesting event to detect and analyze this is "DeviceEvents --> ShellLinkCreateFileEvent", as the AdditionalFields include information such as ShellLinkIconPath, ShellLinkRunAsAdmin, or even the arguments used to execute the .lnk file (ShellLinkCommandLine, which is the most interesting one).

However, the target file of the shortcut is not displayed! This is the most basic information that should appear.

Do you know if this will be included in the future? Is it possible to obtain this information from another event by doing a join?

Navya 20,820 Reputation points Microsoft External Staff Moderator

2024-12-24T19:32:43.0133333+00:00

Hi @viri4to

Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

2 answers

Your answer

Navya 20,820 Reputation points Microsoft External Staff Moderator

2024-12-24T19:32:43.0133333+00:00

Hi @viri4to

Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Clive Watson 7,866 MVP Volunteer Moderator

Have you not got the details in the FileName column, or columns that start with "Initiating..."? especially InitiatingProcessCommandLine
User's image

DeviceEvents
| where AdditionalFields contains "shellLink"
| mv-expand AdditionalFields
| distinct  tostring(AdditionalFields), FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessFileName

viri4to 10 Reputation points

2025-01-17T13:22:07.49+00:00

Hello guys, sorry, I was on vacation.

No, Clive, the log does not show that information, as the FileName field contains the name of the LNK file you created, and the initiatingProcessFileName field shows the process that created that LNK file. Therefore, the information about which executable the LNK points to does not appear.

Here's an example: as you can see in the device timeline, it does show that the LNK file targets Conhost.exe.

However, in the logs from the hunting query, the Target does not appear, as can be observed.

I think it would be good to add the target in the additional fields as well.

Answer 2

User989846-7900 1

Hello,
I noticed sometime this information is available in "AdditionalDetail" column key "ShellLinkIconPath".

I don't know why this information is sometime lacking though.

viri4to 10 Reputation points

2025-07-18T10:16:55.7533333+00:00

Hey man, yeah I saw that field too, but keep in mind it's the path to the icon used by the .lnk, not the target file it executes. I didn't check it, but maybe it doesn't appear sometimes because the .lnk file uses the default icon.

Share via

Microsoft XDR (Defender) - DeviceEvents - ShellLinkCreateFileEvent

2 answers

Your answer