OrionQuests-Setup.exe installer drops LNK file

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

This rule detects the execution of 'OrionQuests-Setup.exe' triggered via a shortcut (.lnk) file. It correlates file creation events involving .lnk files with subsequent process creation events for the specified executable to track potential user execution or masquerading attempts.