UNC6384 LNK Exploitation ZDI-CAN-25373
Detects the execution of a malicious LNK file exploiting the ZDI-CAN-25373 vulnerability, a technique used by threat actors like UNC6384. The exploit involves padding the command line arguments with excessive whitespace to hide the malicious command from the user in the file's properties. This rule identifies command or powershell execution containing a large amount of whitespace characters, which is characteristic of this technique.
YARA-L
