Suspicious PowerShell LNK Execution via User Interaction
Detects the execution of a suspicious PowerShell dropper script, often initiated by a user clicking a malicious file (e.g., LNK). This pattern is common in phishing campaigns, including those by groups like Kimsuky. The detection looks for PowerShell commands that use common evasion techniques (like hidden windows or bypassing execution policies).
Sigma
