LNK File Launches PowerShell as Infection Chain Stage

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•4

Detects the execution of PowerShell with common obfuscation or stealth-related flags (e.g., -enc, -nop, -w hidden) when initiated by CMD or from a LNK file, particularly when originating from Windows Explorer. This is a common pattern for malicious file execution and dropper activity.