StealC Persistence via WScript.Shell LNK Drop in Startup Folder

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•3

This rule detects the creation of .lnk files within the Windows Startup directory. Attackers frequently use this persistence technique to ensure that a malicious script or executable runs automatically upon user login.