Suspicious File Drop Matching Removable Media Malware

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects suspicious file drops over SMB (port 445) that contain both ".lnk" (likely a shortcut file) and "System32" in their content. This combination is often indicative of malware attempting to spread via removable media, using shortcut files to execute malicious payloads, potentially mimicking legitimate system directories.