Forced SMB Authentication via SCF/URL/LNK File Drop in User-Accessible Paths (T1187)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the creation of files with extensions (.scf, .url, .lnk) commonly used for shortcut-based exploitation or social engineering within sensitive user or system directories (e.g., Desktop, Downloads, Temp, NETLOGON, SYSVOL). The rule excludes file creations performed by known reputable software publishers to reduce noise.