Phish - ZIP Archive Dropping LNK File (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•3

Detects archive utilities extracting an LNK (shortcut) file directly to disk, specifically in Downloads or Temp folders, which is a common initial access vector preceding script execution.