Screening Serpens - LNK Drop of PDF Decoy and Executable in Temp Dir

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

This rule detects a suspicious sequence of file creation events occurring within a 60-second window in a temporary directory. The pattern involves the creation of a .lnk file, a .pdf file, and an executable (.exe or .dll). This behavior is characteristic of malicious activity where a shortcut file is used to lure a user into opening a document that subsequently executes a malicious payload.