All Detections

LNK to CMD to PowerShell Chain (T1059.001)

avatar
Ibrahim Saud@tektrix
updated Jun 21, 2026004

Hunts for the full SEO poisoning / Phishing chain: User clicks LNK -> Spawns CMD -> Invokes PowerShell.

Microsoft Sentinel (KQL)