UAC-0226 LNK Dropped into Startup Folder by Archive Utility (T1547.001)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects when common archiving utilities (WinRAR, 7-Zip) write a .lnk file to the Windows Startup folder. This behavior is indicative of an attacker attempting to establish persistence by creating a startup link to a payload via an archiving tool.