ATT&CK technique
View on MITRE ATT&CK →
T1547.009
Shortcut Modification
PersistencePrivilege Escalation
6 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Persistence via Docker Shortcut Modification | production | 2026-09-18 |
| elastic | Persistent Scripts in the Startup Directory | production | 2026-09-18 |
| sigma | Desktop.INI Created by Uncommon Process | test | 2025-12-09 |
| sigma | New Custom Shim Database Created | test | 2023-12-06 |
| sigma | Windows Network Access Suspicious desktop.ini Action | test | 2022-01-16 |
| sigma | Creation Exe for Service with Unquoted Path | test | 2021-12-30 |