Hidden PowerShell Execution via LNK File

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•35

Detects the execution of PowerShell commands embedded within a link (.lnk) file. This rule specifically looks for instances where 'explorer.exe' launches 'cmd.exe', and the command line of 'cmd.exe' contains both 'powershell' and '.lnk', indicating an attempt to execute PowerShell via a shortcut file.