StealC ClickFix Persistence via h2dk2pdvpn0.lnk in Startup Folder

Ibrahim Saud@tektrix

•updated Sep 18, 2026•2•0•4

This rule detects the creation of specific shortcut files (.lnk) within the Windows Startup folder and monitors for the usage of WScript.Shell to interact with the Startup directory. This behavior is commonly associated with persistence mechanisms where an adversary attempts to automatically execute malicious code upon user login.