Modify User Shell Folders Startup Value

calendar Jan 29, 2026 · attack.persistence attack.privilege-escalation attack.t1547.001  ·
Share on: linkedin copy

Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup. This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.

Sigma rule (View on GitHub)

 1title: Modify User Shell Folders Startup Value
 2id: 9c226817-8dc9-46c2-a58d-66655aafd7dc
 3related:
 4    - id: 8f3ab69a-aa22-4943-aa58-e0a52fdf6818
 5      type: similar
 6status: test
 7description: |
 8    Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts.
 9    Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup.
10    This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.    
11references:
12    - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md
13    - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
14author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)
15date: 2022-10-01
16modified: 2026-01-05
17tags:
18    - attack.persistence
19    - attack.privilege-escalation
20    - attack.t1547.001
21logsource:
22    product: windows
23    category: registry_set
24detection:
25    selection:
26        TargetObject|contains:
27            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'
28            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders'
29        TargetObject|endswith:
30            - '\Common Startup'
31            - '\Startup'
32    filter_main_details_null:
33        Details: null
34    filter_main_programdata_startup:
35        Details|contains:
36            - 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup'
37            - '%ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup'
38    filter_main_userprofile_startup_1:
39        Details|contains:
40            - '%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'
41            - '%%USERPROFILE%%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'
42    filter_main_userprofile_startup_2:
43        Details|contains|all:
44            - 'C:\Users\'
45            - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'
46    # Apply more filters if new legitimate paths are identified
47    condition: selection and not 1 of filter_main_*
48falsepositives:
49    - Unknown
50level: high
51regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_susp_user_shell_folders/info.yml
52simulation:
53    - type: atomic-red-team
54      name: Change Startup Folder - HKLM Modify User Shell Folders Common Startup Value
55      technique: T1547.001
56      atomic_guid: acfef903-7662-447e-a391-9c91c2f00f7b

References

Related rules

to-top