LNK File Executes Embedded Encoded PowerShell Command

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

Detects the execution of PowerShell with suspicious command-line arguments (e.g., -enc, -nop, -windowstyle hidden) originating from an LNK file launched by explorer.exe. This pattern is commonly used by adversaries to execute obfuscated malicious payloads embedded within shortcut files.