Larva-24009 LNK-to-PowerShell chain with CoreJob and string-deobfuscated C2
Detects a multi-stage execution chain involving a malicious LNK file that triggers PowerShell. The rule specifically looks for PowerShell commands spawned by explorer.exe or mshta.exe that contain indicators of string deobfuscation (using .Replace), specific job-related keywords (CoreJob), or remote content retrieval (Net.WebClient.DownloadString). The detection correlates these process events with the presence of suspicious LNK files and decoy document files dropped within the temporary directory on the same endpoint.
Microsoft Sentinel (KQL)
