mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-11 10:03:42 +03:00
mukul975
27c6414ca5
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
110 lines
3.2 KiB
Markdown
110 lines
3.2 KiB
Markdown
# API Reference: LNK File and Jump List Forensics
|
|
|
|
## LECmd (Eric Zimmerman) - LNK Parser
|
|
|
|
### Syntax
|
|
```bash
|
|
LECmd.exe -f <file.lnk> # Single file
|
|
LECmd.exe -d <directory> --all # All files in directory
|
|
LECmd.exe -d <dir> --csv <output_dir> # CSV export
|
|
LECmd.exe -d <dir> --json <output_dir> # JSON export
|
|
LECmd.exe -f <file.lnk> -q # Quiet mode
|
|
LECmd.exe -d <dir> -r # Only removable drives
|
|
```
|
|
|
|
### Output Fields
|
|
| Field | Description |
|
|
|-------|-------------|
|
|
| SourceFile | Path to the .lnk file |
|
|
| TargetCreated | Target file creation timestamp |
|
|
| TargetModified | Target file modification timestamp |
|
|
| TargetAccessed | Target file access timestamp |
|
|
| FileSize | Target file size |
|
|
| RelativePath | Relative path to target |
|
|
| WorkingDirectory | Working directory for target |
|
|
| Arguments | Command-line arguments |
|
|
| LocalPath | Full local path to target |
|
|
| VolumeSerialNumber | Volume serial of target drive |
|
|
| DriveType | Fixed, Removable, Network |
|
|
| MachineID | NetBIOS name from tracker block |
|
|
| MacAddress | MAC from distributed tracker |
|
|
|
|
## JLECmd (Eric Zimmerman) - Jump List Parser
|
|
|
|
### Syntax
|
|
```bash
|
|
JLECmd.exe -f <jumplist_file> # Single file
|
|
JLECmd.exe -d <directory> # All jump lists
|
|
JLECmd.exe -d <dir> --csv <output> # CSV export
|
|
JLECmd.exe -d <dir> --fd # Full LNK details
|
|
JLECmd.exe -d <dir> --dumpTo <dir> # Extract embedded LNK files
|
|
```
|
|
|
|
### Jump List Locations
|
|
```
|
|
%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\
|
|
%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\
|
|
```
|
|
|
|
## LnkParse3 (Python)
|
|
|
|
### Installation
|
|
```bash
|
|
pip install LnkParse3
|
|
```
|
|
|
|
### Usage
|
|
```python
|
|
import LnkParse3
|
|
|
|
with open("shortcut.lnk", "rb") as f:
|
|
lnk = LnkParse3.lnk_file(f)
|
|
|
|
info = lnk.get_json()
|
|
print(info["data"]["relative_path"])
|
|
print(info["header"]["creation_time"])
|
|
print(info["link_info"]["local_base_path"])
|
|
|
|
# Extra data blocks
|
|
extra = info.get("extra", {})
|
|
tracker = extra.get("DISTRIBUTED_LINK_TRACKER_BLOCK", {})
|
|
print(tracker.get("machine_id"))
|
|
print(tracker.get("mac_address"))
|
|
```
|
|
|
|
## Shell Link Binary Format (MS-SHLLINK)
|
|
|
|
### Header Structure (76 bytes)
|
|
| Offset | Size | Field |
|
|
|--------|------|-------|
|
|
| 0 | 4 | HeaderSize (0x0000004C) |
|
|
| 4 | 16 | LinkCLSID |
|
|
| 20 | 4 | LinkFlags |
|
|
| 24 | 4 | FileAttributes |
|
|
| 28 | 8 | CreationTime (FILETIME) |
|
|
| 36 | 8 | AccessTime (FILETIME) |
|
|
| 44 | 8 | WriteTime (FILETIME) |
|
|
| 52 | 4 | FileSize |
|
|
| 56 | 4 | IconIndex |
|
|
| 60 | 4 | ShowCommand |
|
|
|
|
### Common App IDs (Jump Lists)
|
|
| App ID | Application |
|
|
|--------|-------------|
|
|
| 1b4dd67f29cb1962 | Windows Explorer |
|
|
| 5d696d521de238c3 | Google Chrome |
|
|
| ecd21b58c2f65a4f | Firefox |
|
|
| 1bc392b8e104a00e | Remote Desktop (mstsc) |
|
|
| b8ab77100df80ab2 | Microsoft Word |
|
|
| cfb56c56fa0f0478 | PuTTY |
|
|
| b74736c2bd8cc8a5 | WinSCP |
|
|
|
|
## Suspicious LNK Indicators
|
|
| Pattern | Concern |
|
|
|---------|---------|
|
|
| PowerShell in arguments | Script execution via shortcut |
|
|
| cmd.exe /c in target | Command execution chain |
|
|
| UNC path to IP | Network-based payload delivery |
|
|
| Base64 encoded arguments | Obfuscated commands |
|
|
| mshta/wscript target | Living-off-the-land execution |
|