Local File Execution via Startup URL

Ethan Andrews@eandrews

•updated Feb 28, 2026•9•0•67

Detects persistence via an Internet Shortcut (.url) file in a startup folder that points to a local executable (file://). This is a known TTP of the PHALT#BLYX campaign.