Suspicious LNK-to-LOLBAS Execution from Explorer
Detects the execution of common Living Off The Land Binaries and Scripts (LOLBAS) initiated from Windows Explorer. The detection logic specifically looks for command lines that contain indicators of obfuscation or padding, which are common techniques used in malicious LNK (shortcut) files to hide their true purpose. This rule identifies processes like mshta.exe, powershell.exe, cmd.exe, certutil.exe, cscript.exe, and wscript.exe being launched by explorer.exe with suspicious command-line arguments.
Microsoft Sentinel (KQL)
