Paper Werewolf Winrar Startup Persistence

nomit vyas@xoxo

•updated Dec 22, 2025•0•39

Detects when the WinRAR process creates an executable or shortcut file in a user's Startup folder. This technique is used by adversaries, such as Paper Werewolf, to establish persistence.