StealC Persistence via WScript.Shell LNK Drop in Startup Folder
Detects the creation of .lnk files within the user startup directory. The rule flags suspicious activity by monitoring for specific file names often associated with the StealC information stealer, or when these files are created by common scripting hosts like PowerShell, WScript, or CScript.
Cortex XDR
