UAC-0226 WinRAR ADS Path Traversal LNK Drop into Startup Folder
Detects the WinRAR.exe process creating a .lnk shortcut file within the user's Startup directory. This behavior is indicative of an exploitation attempt (e.g., UAC-0226 related NTFS path traversal vulnerabilities) where an attacker plants a persistence mechanism via a malicious archive extraction.
YARA-L
