QUICAgent Persistence via SystemIn.lnk PowerShell WScript.Shell

Ibrahim Saud@tektrix

•updated 14 days ago•0•0•4

Detects the creation of a 'SystemIn.lnk' persistence shortcut on Windows systems using PowerShell and the WScript.Shell COM object. This activity is associated with the QUICAgent backdoor, part of the QUICSILVER operation, which uses temporary PowerShell scripts to establish persistence.