StealC LNK persistence dropped via WScript.Shell into Startup folder
Detects the creation of shortcut files (.lnk) within the current user's Startup folder using Windows command line utilities or scripts that leverage the WScript.Shell COM object. This behavior is indicative of an adversary establishing persistence to ensure malicious payloads execute upon user logon.
Splunk (SPL)
