CryptoBandits USB .lnk worm launching hidden cmd.exe with /c start
Detects suspicious command-line execution patterns where 'cmd.exe' is spawned by 'explorer.exe' (often indicative of .lnk file execution) and the command line contains specific arguments associated with malicious shortcut files. The rule looks for '/c start' and indicators of payload staging in Public Documents or removable drives, while excluding known benign system paths.
Microsoft Sentinel (KQL)
