create-shortcut-via-ishelllink.yml

rule:
  meta:
    name: create shortcut via IShellLink
    namespace: host-interaction/file-system/write
    authors:
      - matthew.williams@mandiant.com
    scope: function
    references:
      - https://docs.microsoft.com/en-us/windows/win32/shell/links#creating-a-shortcut-and-a-folder-shortcut-to-a-file
  features:
    - and:
      - bytes: 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 = CLSID_ShellLink
      - or:
        - bytes: EE 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 = IID_IShellLinkA
        - bytes: F9 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 = IID_IShellLinkW
      - bytes: 0B 01 00 00 00 00 00 00 C0 00 00 00 00 00 00 46 = IID_IPersistFile
      - offset: 0x50 = psl->SetPath
      - offset: 0x18 = ppf->Save
      - api: ole32.CoCreateInstance