Hidden LNK File via Attrib
Detects the use of the 'attrib.exe' utility to set the hidden attribute on a .lnk file. Adversaries may use this technique to hide malicious shortcuts used for persistence or initial execution.
Microsoft Sentinel (KQL)
Detects the use of the 'attrib.exe' utility to set the hidden attribute on a .lnk file. Adversaries may use this technique to hide malicious shortcuts used for persistence or initial execution.
Already have an account?