Modify User Shell Folders Startup Value

calendar Aug 17, 2023 · attack.persistence attack.privilege_escalation attack.t1547.001  ·
Share on: linkedin copy

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

Sigma rule (View on GitHub)

 1title: Modify User Shell Folders Startup Value
 2id: 9c226817-8dc9-46c2-a58d-66655aafd7dc
 3status: experimental
 4description: Detect modification of the startup key to a path where a payload could be stored to be launched during startup
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1547.001/T1547.001.md
 7author: frack113
 8date: 2022/10/01
 9modified: 2023/08/17
10tags:
11    - attack.persistence
12    - attack.privilege_escalation
13    - attack.t1547.001
14logsource:
15    product: windows
16    category: registry_set
17detection:
18    selection:
19        TargetObject|contains: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'
20        TargetObject|endswith: 'Startup' # cover Common Startup and Startup
21        # can use Details|contains: path if get too many FP
22    condition: selection
23falsepositives:
24    - Unknown
25level: high

References

Related rules

to-top