PowerShell creates SystemIn.lnk persistence shortcut via WScript.Shell

Ethan Andrews@eandrews

•updated Aug 17, 2026•2•0•7

Detects the creation of a 'SystemIn.lnk' shortcut file within the Windows Startup folder, as well as the execution of temporary PowerShell scripts ('create_lnk_*.ps1') that use WScript.Shell to establish persistence. This behavior is associated with the QUICAgent backdoor attributed to Operation QUICSILVER.