BIOC
Informational
✕
Office document embeds a .LNK file
An Office process spawned a process with an argument indicating that the document contains an embedded .LNK file.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)
Indicator:
Process action type = execution AND target process cmd = *{00021401-0000-0000-C000-000000000046}* Process initiated by = winword.exe , excel.exe , powerpnt.exe Host host os = windows
Preventable: yes