Phishing delivers password-protected RAR via shortened URL (LucidPawn)
Detects emails containing a RAR attachment combined with a shortened URL. This combination is a common technique used in phishing campaigns to deliver malicious payloads while attempting to evade security filters.
Microsoft Sentinel (KQL)

