UAC-0226 WinRAR ADS Path Traversal LNK Dropped into Startup Folder
Detects the creation of files within Windows startup folders originating from a WinRAR process. This behavior is indicative of an adversary using WinRAR to extract or drop malicious persistence items, such as shortcuts (.lnk) or executables, into auto-start locations to maintain persistence across reboots.
Splunk (SPL)
