PHALT BLYX Startup URL Persistence

Lacey Cochrane@NullVectorX

•updated Jan 7, 2026•5•1•114

Detects the creation of .url files in the Windows Startup folder, which can be used for persistence. Specifically identifies a known IOC for PHALT BLYX malware ('DeleteApp.url') and flags other suspicious .url file creations in the Startup folder. This rule filters out common browser processes that might legitimately create .url files.