Payload Execution Shortly After Malicious Link Click From Email
Detects process execution shortly after a user clicks a malicious link delivered via spearphishing email, indicating successful initial-access payload execution.
Microsoft Sentinel (KQL)
