Potential UAC-0184 LNK Payload Delivery via BITSAdmin and MSHTA

Kaung Khant Ko@kaungkhantko

•updated May 24, 2026•0•91

Detects the use of bitsadmin to transfer a payload followed by mshta.exe execution, a pattern observed in UAC-0184 LNK file lures.