PowerShell Download from LNK File Execution
Detects instances where a LNK file execution is followed by the launch of a PowerShell process that contains command-line arguments for downloading and/or executing content from the internet. This behavior is the initial execution step in the attack chain detailed in the referenced Fortinet report.
Microsoft Sentinel (KQL)
