Startup Folder File Write
A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
Sigma rule (View on GitHub)
1title: Startup Folder File Write
2id: 2aa0a6b4-a865-495b-ab51-c28249537b75
3related:
4 - id: 28208707-fe31-437f-9a7f-4b1108b94d2e
5 type: similar
6status: test
7description: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
8references:
9 - https://github.com/OTRF/detection-hackathon-apt29/issues/12
10 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md
11author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
12date: 2020/05/02
13modified: 2022/10/07
14tags:
15 - attack.persistence
16 - attack.t1547.001
17logsource:
18 product: windows
19 category: file_event
20detection:
21 selection:
22 TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\StartUp'
23 filter_update:
24 - Image: 'C:\Windows\System32\wuauclt.exe'
25 - TargetFilename|startswith: 'C:\$WINDOWS.~BT\NewOS\'
26 condition: selection and not filter_update
27falsepositives:
28 - FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate
29level: medium
References
-
Description The attacker establishes persistent access to the victim by creating a malicious payload in the Windows Startup folder (T1060)
Read More -
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient. - OTRF/ThreatHunter-Playbook
Read More
Related rules
- Potential Persistence Attempt Via Run Keys Using Reg.EXE
- Suspicious Run Key from Download
- Windows Webshell Strings
- Certificate Request Export to Exchange Webserver
- Code Injection by ld.so Preload