Startup folder shortcut relaunching SNOWBELT AutoHotkey loader
Detects persistence achieved via a shortcut (.lnk) file created in a user's Startup folder that launches an AutoHotkey script. The rule specifically looks for AutoHotkey processes executing scripts from common writable locations (Temp, AppData) with command-line arguments referencing functions (CheckHeadlessEdge, FindAndRunTask) associated with the SNOWBELT loader and UNC6692's Edgecution malware suite.
Microsoft Sentinel (KQL)
