Rudra Gurram
@Rudra1 follower4 downloads9 copies0 likes263 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
MITRE Techniques
1
1
1
1
1
Detects a process execution where the parent process is explorer.exe and its command line indicates it is launching an LNK file from within a ZIP archive. This is a common TTP for initial access, where users are tricked into opening malicious LNK files embedded in ZIP archives. This version specifically looks for rundll32.exe as the child process, which is a common technique for proxy execution.
