Phish - LNK Execution Bypassing MOTW (T1204.001)
Correlates the execution of a recently dropped LNK file that triggers cmd.exe or powershell.exe, deliberately bypassing Mark-of-the-Web (MOTW) warnings.
Microsoft Sentinel (KQL)
Correlates the execution of a recently dropped LNK file that triggers cmd.exe or powershell.exe, deliberately bypassing Mark-of-the-Web (MOTW) warnings.
Already have an account?