Findstr Launching .lnk File (33339be3-148b-4e16-af56-ad16ec6c7e7b)

Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Steganography - T1027.003 (c2e147a9-d1a8-4074-811a-d8789202d916)	Attack Pattern	Findstr Launching .lnk File (33339be3-148b-4e16-af56-ad16ec6c7e7b)	Sigma-Rules	1
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0)	Attack Pattern	Findstr Launching .lnk File (33339be3-148b-4e16-af56-ad16ec6c7e7b)	Sigma-Rules	1
Indirect Command Execution - T1202 (3b0e52ce-517a-4614-a523-1bd5deef6c5e)	Attack Pattern	Findstr Launching .lnk File (33339be3-148b-4e16-af56-ad16ec6c7e7b)	Sigma-Rules	1
Steganography - T1027.003 (c2e147a9-d1a8-4074-811a-d8789202d916)	Attack Pattern	Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	2