Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

ZDI-CAN-25373 Windows Shortcut Exploit Abused Detection

Steven Lim@KQLWizard

•updated Jul 1, 2025•7•0•66

KQL Query

Microsoft Sentinel (KQL)

Tags

DS0035 - Internet Scan T1596.005 - Scan Databases T1087.001 - Local Account T1588.005 - Exploits T1587.004 - Exploits T1547.009 - Shortcut Modification S0106 - cmd S0123 - xCmd S0500 - MCMD T1086 - PowerShell T1504 - PowerShell Profile T1059.001 - PowerShell TA0043 - Reconnaissance TA0007 - Discovery TA0042 - Resource Development TA0003 - Persistence TA0004 - Privilege Escalation TA0002 - Execution File Creation Command Execution Script Execution Exploit Attempt Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?