All Detections

VS Code Phishing - Dfshim.dll Application Launch (T1218.011)

avatar
Ibrahim Saud@tektrix
updated Jun 21, 2026001

Identifies dfshim.dll invoked via ShOpenVerbApplication processing the fake Adobe manifest parameters.

Microsoft Sentinel (KQL)