Windows Explorer ZIP Extraction Dropping Startup Folder Shortcut
Alert on explorer.exe writing Startup-folder LNK files whose names include {0AFACED1-E828-11D1-9187-B532F1E9575D}, indicating shortcut-based persistence.
- Product
- windows
- Category
- file_event
- Author
- Greg (rule) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file activity consistent with a ZIP-based phishing flow where a user expands content via Windows Explorer and results in creation of a malicious shortcut in the Startup folder. The shortcut naming includes the specific {0AFACED1-E828-11D1-9187-B532F1E9575D} pattern associated with a folder shortcut operation. It relies on Windows file event telemetry showing a .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D} target under the Startup path created by explorer.exe.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Explorer ZIP Extraction Dropping Startup Folder Shortcut
id: 90ce7e31-f62b-4ddb-8b23-ae0f71b4b5cc
status: test
description: This rule flags file activity consistent with a ZIP-based phishing flow where a user expands content via Windows Explorer and results in creation of a malicious shortcut in the Startup folder. The shortcut naming includes the specific {0AFACED1-E828-11D1-9187-B532F1E9575D} pattern associated with a folder shortcut operation. It relies on Windows file event telemetry showing a .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D} target under the Startup path created by explorer.exe.
references:
- https://twitter.com/jonasLyk/status/1549338335243534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ripzip_attack.yml
author: Greg (rule), Huntrule Team
date: 2022-07-21
modified: 2023-01-05
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains|all:
- \Microsoft\Windows\Start Menu\Programs\Startup
- .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D}
Image|endswith: \explorer.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a6976974-ea6f-4e97-818e-ea08625c52cb
type: derived