APT36 Deceptive Hard Link Creation
Detects the creation of a hard link using mklink.exe, where the source is in C:\ProgramData and the destination is an executable in a user's AppData or Temp directory. This technique was observed in an APT36 campaign to stage and execute payloads while evading path-based detections.
Microsoft Sentinel (KQL)
