PowerShell writes SystemIn.lnk to Startup folder for persistence
This rule detects when PowerShell is used to create or modify a LNK file within the Windows Startup folder. Adversaries often place malicious LNK files in this directory to achieve persistence, ensuring their code executes upon user login.
Microsoft Sentinel (KQL)
