All Detections

PS1Bot LNK File Creation in Startup

avatar
Ibrahim Saud@tektrix
updated Jun 17, 2026002

Detects PS1Bot generating randomly named .lnk files in the Windows Startup folder using PowerShell.

Microsoft Sentinel (KQL)