LNK dropping and execution via cmd.exe

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Detects the execution of 'cmd.exe' with a command line that includes a reference to a .lnk file. This behavior is often associated with adversaries using shortcut files to execute malicious code, potentially as part of initial access or execution tactics.