Malicious LNK Persistence Dropped via WScript.Shell in Startup Folder

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•1

Detects the creation of a .lnk shortcut file within the Windows Startup folder, which is a common persistence mechanism. The detection logic also flags the usage of WScript.Shell and CreateShortcut methods, which are frequently abused by scripts (e.g., VBScript or PowerShell) to programmatically establish this persistence.