Embedded executable file run via shortcut

Identifies execution of an embedded executable extracted from a shortcut (.lnk) file via script or command interpreters, a technique commonly used to deliver and launch payloads through malicious links.

• Platform: Windows
• Severity: High
• MITRE Tactic: Execution
• MITRE Techniques: T1204, T1204.002

Back to all rules