UAC-0226 WinRAR Path Traversal Dropping LNK into Startup Folder
Detects WinRAR application writing a shortcut (.lnk) file directly into the Windows Startup folder. This activity is indicative of exploitation of NTFS Alternate Data Stream (ADS) path traversal vulnerabilities (such as CVE-2025-8088 or CVE-2025-6218) to achieve persistence by placing a malicious shortcut in the user's startup directory without triggering typical user interaction warnings.
Sigma
