CastleLoader - PowerShell Creating Startup Folder Shortcut
Detects PowerShell creating shortcuts within the Windows Startup folder using Environment.GetFolderPath and CreateShortcut.
Microsoft Sentinel (KQL)
Detects PowerShell creating shortcuts within the Windows Startup folder using Environment.GetFolderPath and CreateShortcut.
Already have an account?