APT37 NarwhalRAT: Obfuscated LNK cmd.exe Followed by Python Spawn
Detects a suspicious command line execution from explorer.exe involving syswow64\cmd.exe with specific variable substitution obfuscation patterns often associated with APT37's LNK-based NarwhalRAT delivery. The rule correlates this command execution with the subsequent launch of Python or userscreen.exe within a 5-minute window, a pattern indicative of second-stage payload delivery.
Microsoft Sentinel (KQL)
