Suspicious LNK File Activity in User Directories
This rule detects the creation, modification, copying, or moving of Windows shortcut (.lnk) files into sensitive user directories such as Desktop, Documents, and Start Menu folders. Adversaries often use .lnk files for persistence, execution, or to deliver malicious payloads, especially when placed in locations that are frequently accessed or automatically executed by the system or user.
YARA-L
