Findstr or Find Executing LNK File
Detects the execution of 'find.exe' or 'findstr.exe' where the command line arguments include a '.lnk' file. This behavior has been observed in attacks, such as the HHS redirect attack, where adversaries use these legitimate Windows utilities to indirectly execute malicious shortcut files.
Sigma
