All Detections

Shortcut File Modified for Autostart

avatar
Darshan Thummar@Mighty
updated Jun 13, 2026002

Detects modification of LNK shortcut files in startup folders for autostart persistence

Microsoft Sentinel (KQL)