QR Code Phishing (Quishing) Execution Chain Detection — T1566.001

Ankit Mehta@Secvyn

•updated Jun 27, 2026•7•0•6

Detects potential execution chains related to QR code phishing (Quishing) by monitoring for suspicious process creation or outbound network connections originating from document readers, office applications, and QR scanner utilities. It covers three primary vectors: suspicious process spawning (e.g., Office apps launching cmd or powershell), non-standard network connections from document readers, and malicious URL-based LNK files spawned via explorer.exe.