Suspicious Edge LNK in Startup Folder

Elgonad .@elgonad

•updated Apr 10, 2026•19•0•675

Detects the creation of a shortcut (.lnk) file in the Windows Startup folder containing 'Edge' or 'msedge' in its name. This matches the persistence mechanism used by LucidRook and its droppers (like LucidPawn) which drop a disguised Microsoft Edge shortcut to execute a renamed DISM binary.