LNK Command-Line Padding for Obfuscation

Ethan Andrews@eandrews

•updated Feb 20, 2026•5•0•59

Detects processes launched by Windows Explorer where the command line contains excessive whitespace or hidden control characters. This pattern is indicative of CVE-2025-9491, a technique used to hide malicious arguments from the LNK Properties dialog.