Startup Folder File Write
A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
Sigma rule (View on GitHub)
1title: Startup Folder File Write
2id: 2aa0a6b4-a865-495b-ab51-c28249537b75
3related:
4 - id: 28208707-fe31-437f-9a7f-4b1108b94d2e
5 type: similar
6status: test
7description: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
8references:
9 - https://github.com/OTRF/detection-hackathon-apt29/issues/12
10 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md
11author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
12date: 2020-05-02
13modified: 2025-10-17
14tags:
15 - attack.privilege-escalation
16 - attack.persistence
17 - attack.t1547.001
18logsource:
19 product: windows
20 category: file_event
21detection:
22 selection:
23 TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\StartUp'
24 filter_main_update:
25 - Image: 'C:\Windows\System32\wuauclt.exe'
26 - TargetFilename|startswith: 'C:\$WINDOWS.~BT\NewOS\'
27 filter_optional_onenote:
28 Image|endswith: '\ONENOTE.EXE'
29 TargetFilename|endswith: '\Send to OneNote.lnk'
30 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
31falsepositives:
32 - FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate
33level: medium
References
-
Description The attacker establishes persistent access to the victim by creating a malicious payload in the Windows Startup folder (T1060)
Read More -
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient. - OTRF/ThreatHunter-Playbook
Read More
Related rules
- CurrentControlSet Autorun Keys Modification
- Direct Autorun Keys Modification
- File Creation In Suspicious Directory By Msdt.EXE
- Forest Blizzard APT - Custom Protocol Handler Creation
- Forest Blizzard APT - Custom Protocol Handler DLL Registry Set