PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Detects PowerShell writing .lnk files into the Windows Startup folder, a common persistence mechanism.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Christopher Peacock '@securepeacock', SCYTHE (SigmaHQ), DRL 1.1
Published: 2021-10-24
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547.001Registry Run Keys / Startup Folder
Priv Esc
- T1547.001Registry Run Keys / Startup Folder
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies instances where PowerShell or pwsh writes shortcut files (.lnk) to a Windows Startup location. Attackers commonly use Startup shortcuts to achieve persistence by automatically launching malicious code when a user signs in. It relies on Windows file event telemetry capturing process image name and the target file path containing Startup and ending with .lnk.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange

Suspicious Run Key Persistence Named AppResolver (via registry_set)

Suspicious SystemBC Persistence via Run Key to ProgramData Script

Suspicious Interlock RAT Persistence via HKCU Run Key Registration to AppData Payload (via process_creation)

Suspicious SOCKS Proxy Persistence via SystemBC PowerShell Run Key

Suspicious Run Key Persistence Referencing PowerShell Script via registry_set

Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)

Malicious PXA Stealer Persistence via Windows Update Service Run Key (via registry_set)

Suspicious NetSupport client32 Persistence via Run Key from ProgramData

Suspicious Run Key Persistence Named NvidiaDriverUpdate (via registry_set)

PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Pivot detection · T1547.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-creating-startup-shortcut-lnk-files-for-persistence-92fa78e7

title: PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)
id: c142a052-871b-445e-b5d3-a57811aca045
status: test
description: This rule identifies instances where PowerShell or pwsh writes shortcut files (.lnk) to a Windows Startup location. Attackers commonly use Startup shortcuts to achieve persistence by automatically launching malicious code when a user signs in. It relies on Windows file event telemetry capturing process image name and the target file path containing Startup and ending with .lnk.
references:
  - https://redcanary.com/blog/intelligence-insights-october-2021/
  - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml
author: Christopher Peacock '@securepeacock', SCYTHE, Huntrule Team
date: 2021-10-24
modified: 2023-02-23
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetFilename|contains: \start menu\programs\startup\
    TargetFilename|endswith: .lnk
  condition: selection
falsepositives:
  - Depending on your environment accepted applications may leverage this at times. It is recommended to search for anomalies inidicative of malware.
level: high
license: DRL-1.1
related:
  - id: 92fa78e7-4d39-45f1-91a3-8b23f3f1088d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL