VHD Mount Delivers PDF-Spoofed LNK Lure (QUICSILVER)
Detects the creation or renaming of a .pdf file in the root directory followed closely (within 300 seconds) by the creation or renaming of a .vhd (Virtual Hard Disk) file on the same device. This pattern may indicate the use of malicious PDF documents as a decoy or delivery mechanism to initiate the mounting or dropping of virtual disk images for payload execution or data staging.
Microsoft Sentinel (KQL)
