PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Detects PowerShell writing .lnk files into the Windows Startup folder, a common persistence mechanism.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Christopher Peacock '@securepeacock', SCYTHE (SigmaHQ), DRL 1.1
Published: 2021-10-24
Updated: 2026-07-31

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547.001Registry Run Keys / Startup Folder
Priv Esc
- T1547.001Registry Run Keys / Startup Folder
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies instances where PowerShell or pwsh writes shortcut files (.lnk) to a Windows Startup location. Attackers commonly use Startup shortcuts to achieve persistence by automatically launching malicious code when a user signs in. It relies on Windows file event telemetry capturing process image name and the target file path containing Startup and ending with .lnk.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange

Malicious Run Key Persistence Referencing DLL in User Documents

PlugX Persistence via Run Key Named AAM Updatevlm

Suspicious Autorun Registry Persistence via sausageLoop Run Key

Malicious BabyLockerKZ Run Key Persistence

Suspicious Run Key Persistence Pointing To User-Writable Path

Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)

Persistence Run Key Pointing to svchost.exe in AppData Roaming

URL Shortcut File Created in Startup Folder for Persistence

Suspicious Run Key Persistence via UpdateCheck Value in Operation TrueChaos

PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Pivot detection · T1547.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-creating-startup-shortcut-lnk-files-for-persistence-92fa78e7

title: PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)
id: c142a052-871b-445e-b5d3-a57811aca045
status: test
description: This rule identifies instances where PowerShell or pwsh writes shortcut files (.lnk) to a Windows Startup location. Attackers commonly use Startup shortcuts to achieve persistence by automatically launching malicious code when a user signs in. It relies on Windows file event telemetry capturing process image name and the target file path containing Startup and ending with .lnk.
references:
  - https://redcanary.com/blog/intelligence-insights-october-2021/
  - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml
author: Christopher Peacock '@securepeacock', SCYTHE, Huntrule Team
date: 2021-10-24
modified: 2023-02-23
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetFilename|contains: \start menu\programs\startup\
    TargetFilename|endswith: .lnk
  condition: selection
falsepositives:
  - Depending on your environment accepted applications may leverage this at times. It is recommended to search for anomalies inidicative of malware.
level: high
license: DRL-1.1
related:
  - id: 92fa78e7-4d39-45f1-91a3-8b23f3f1088d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL