Suspicious LNK Double Extension File Created

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•2

Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.