PowerShell Creating Startup Shortcut for Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•24

Detects PowerShell writing shortcut (.lnk) files into the Windows startup directory. This technique is commonly used by adversaries to establish persistence, ensuring their malicious code executes each time a user logs in. The rule specifically looks for PowerShell (powershell.exe or pwsh.exe) as the process creating these shortcut files in the 'Start Menu\Programs\Startup' path.