Starland RAT Startup Folder LNK Persistence via WScript.Shell Targeting pythonw.exe
Detects the creation of a Windows Shortcut (.lnk) file in the Startup folder using WScript.Shell, often used by the Starland RAT or similar malware to establish persistence. The rule monitors command lines for the combination of WScript.Shell invocation, the CreateShortcut method, and targeting of pythonw.exe or LICENSE.txt files.
Sigma
