CrimsonRAT hard link creation via mklink to ProgramData\doxc

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•0

Detects the use of mklink.exe or cmd.exe with mklink arguments to create symbolic links associated with specific file paths (ProgramData\doxc) or specific suspicious filenames (hzwzucr_widsisa.exe). This behavior is often associated with malware persistence or evasion, where adversaries link malicious binaries to disguise their location or execution source.