LNK-launched PowerShell drops TXT and Discord-masquerading executable (XWorm)

ills3c Intel&Coffee@Ills3C

•updated 4 days ago•0•0•2

Detects PowerShell processes spawned via shortcut files (lnk) using suspicious command-line parameters that subsequently create both a text file and a Discord-named executable on the same device within a 10-minute window.