All Detections

Suspicious LNK Execution From Discord

avatar
Tim Peck@timpeck
updated Sep 24, 202520124

Detects a PowerShell process launch shortly after a .LNK file was created by Discord. This pattern is indicative of malicious LNK files distributed via Discord to gain initial execution.

YARA-L