UAC-0226 Startup LNK Nested PowerShell IEX C:\ProgramData\WC3 Execution
This rule detects potentially malicious PowerShell or Command Prompt execution patterns by monitoring for suspicious command-line flags often used by malware for stealth, such as hidden windows, script policy bypasses, and file content retrieval from specific directories. It identifies processes that exhibit multiple risk-indicating characteristics, such as being launched from LNK files, using execution policy bypass flags, or performing remote file content access.
Splunk (SPL)
