UAC-0226 WinRAR Drops LNK into Startup Folder for Persistence
Detects the creation or modification of shortcut (.lnk) files within the Windows Startup folder by known archive utilities (e.g., WinRAR, 7-Zip). This behavior is highly suspicious as these tools are commonly leveraged by adversaries to drop malicious payloads or persistence mechanisms into the user's startup directory.
Cortex XDR
