Multi‑Stage LOLBin Abuse: Cmdkey Credential Injection Followed by Remote DLL Execution
Detects ClickFix‑style social engineering where a user is tricked into executing a single pasted command that chains multiple malicious actions: storing attacker‑controlled credentials via cmdkey and executing a remote DLL over a UNC path using regsvr32. This fileless, LOLBin‑based execution enables credential abuse and remote code execution without dropping an initial payload to disk.
Microsoft Sentinel (KQL)
