Star Blizzard RedFlick: VHDX LNK chain (conhost→cmd→ssh PermitLocalCommand→control.exe CPL launch)
Detects a specific multi-stage infection chain associated with Star Blizzard. The sequence begins with a command shell launched under conhost.exe executing SSH with PermitLocalCommand enabled, followed by the execution of a control panel (.cpl) file via control.exe within a two-hour window.
Microsoft Sentinel (KQL)
