Suspicious Shortcut File Creation via PowerShell

Tim P@bobbyTablez

•updated Jul 28, 2025•4•1•88

This detection looks for a method of creating potentially malicious LNK (Shortcut) files by using the CreateShortcut() function. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.