Shortcut File Modified for Autostart Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects network traffic that indicates a shortcut (.lnk) file is being modified or created in a 'Startup' directory, which is a common technique for establishing autostart persistence on Windows systems. The rule specifically looks for TCP traffic on port 445 (SMB) containing the strings 'Startup' and '.lnk' (case-insensitive).