Lunar Client Modrinth Chain PoC — .lnk Drop or Java/Lunar Spawning Shell (lunar-modrinth-chain-poc)
This rule detects potentially malicious activity associated with Java applications or the Lunar Client, specifically targeting the creation of shortcut files (.lnk, .command, .desktop) by Java processes, and the unexpected spawning of shells or interpreters by 'javaw.exe' or Lunar Client processes. These patterns are consistent with modpack-based Remote Code Execution (RCE) attempts or abuse of Electron IPC mechanisms.
Cortex XDR
