Windows Explorer ZIP Extraction Dropping Startup Folder Shortcut

Alert on explorer.exe writing Startup-folder LNK files whose names include {0AFACED1-E828-11D1-9187-B532F1E9575D}, indicating shortcut-based persistence.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Greg (rule) (SigmaHQ), DRL 1.1
Published: 2022-07-21
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547Boot or Logon Autostart Execution
Priv Esc
- T1547Boot or Logon Autostart Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file activity consistent with a ZIP-based phishing flow where a user expands content via Windows Explorer and results in creation of a malicious shortcut in the Startup folder. The shortcut naming includes the specific {0AFACED1-E828-11D1-9187-B532F1E9575D} pattern associated with a folder shortcut operation. It relies on Windows file event telemetry showing a .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D} target under the Startup path created by explorer.exe.

Reporting behind it

Related detections8 linkedT1547 — drag to rearrange

Suspicious Boot Verification Program Persistence via Registry (via registry_set)

SwimSnake Driver Execution Persistence via Session Manager PlatformExecute (via registry_set)

Suspicious Session Manager Execute Value Modification for Persistence (via registry_set)

Suspicious RDP Wds StartupPrograms Persistence Modification (via registry_set)

Windows: GPO Modification Adds Startup/Logon Script References

Windows grpconv Utility Execution with Output Option

Windows: Suspicious Driver Installation via pnputil.exe

Windows Registry Run Key Modification via winekey or team9 backdoor

Windows Explorer ZIP Extraction Dropping Startup Folder Shortcut

Pivot detection · T1547 · 8 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-events-detect-explorer-expanded-lnk-persistence-in-startup-folder-w-a6976974

title: Windows Explorer ZIP Extraction Dropping Startup Folder Shortcut
id: 90ce7e31-f62b-4ddb-8b23-ae0f71b4b5cc
status: test
description: This rule flags file activity consistent with a ZIP-based phishing flow where a user expands content via Windows Explorer and results in creation of a malicious shortcut in the Startup folder. The shortcut naming includes the specific {0AFACED1-E828-11D1-9187-B532F1E9575D} pattern associated with a folder shortcut operation. It relies on Windows file event telemetry showing a .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D} target under the Startup path created by explorer.exe.
references:
  - https://twitter.com/jonasLyk/status/1549338335243534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ripzip_attack.yml
author: Greg (rule), Huntrule Team
date: 2022-07-21
modified: 2023-01-05
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
      - \Microsoft\Windows\Start Menu\Programs\Startup
      - .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D}
    Image|endswith: \explorer.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a6976974-ea6f-4e97-818e-ea08625c52cb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL