Windows Startup Shortcut Lnk Creation
Detects creation or overwrite of the Windows shortcut name pattern observed in the Guildma Startup-folder persistence mechanism when the creator is a script interpreter, LOLBin, or process running from a user-writable location. The Cortex XDR Sigma backend maps TargetFilename to action_file_name and cannot represent the Startup directory path; use the companion native XQL rule for path-based detection.
Sigma
