Fox Tempest - LNK to Signed Binary Execution (T1204.002)
Identifies LNK shortcut files contained in ISOs executing the Fox Tempest signed payload, bypassing initial scrutiny. This rule specifically looks for 'explorer.exe' initiating a process with a command line containing '.lnk' and then joins this with image load events where the initiating process's signature status is 'Valid'. This combination aims to detect the execution of malicious LNK files that launch signed binaries, a technique used by threat actors like Fox Tempest.
Microsoft Sentinel (KQL)
