Lunar Client shell.openExternal ACE via Modrinth .mrpack .lnk chain
Detects unexpected child process execution spawned by the Lunar Client Electron main process. This rule is designed to identify potential exploitation attempts, such as the lunar-modrinth-chain exploit, where malicious files (e.g., .mrpack entries) could lead to arbitrary code execution via shell.openExternal calls.
YARA-L
