LNK masquerading as PDF launches hidden PowerShell
Detects the execution of PowerShell with hidden window styles originating from a shortcut (.lnk) file. This behavior is commonly associated with malicious LNK files masquerading as PDF documents, often used as an initial access vector to launch stage-one payloads from temporary directories.
Microsoft Sentinel (KQL)
