QUICSILVER Persistence via SystemIn.lnk Startup Shortcut PS Script

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•2

Detects the creation of a shortcut file named 'SystemIn.lnk' using PowerShell, a technique associated with the QUICSILVER malware to establish persistence. The rule monitors for PowerShell command-line arguments involving 'WScript.Shell' and 'CreateShortcut' alongside the specific file name.