Query: detection rule: Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common
Matching passage: Sigma rule: Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common. Logsource: windows / file_event. Rule: title: Suspicious Startup Folder Persistence id: 28208707-fe31-437f-9a7f-4b1108b94d2e related: - id: 2aa0a6b4-a865-495b-ab51-c28249537b75 type: similar status: test description: 'Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems. ' references: - https://github.com/last-byte/PersistenceSniper - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/ - https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-08-10 modified: 2025-10-12 tags: - attack.privilege-escalation - attack.execution - attack.t1204.002 - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Windows\Start Menu\Programs\Startup\ TargetFilename|endswith: - .bat - .cmd - .dll - .hta - .jar - .js - .jse - .msi - .ps1 - .psd1 - .psm1 - .scr - .url - .vba - .vbe - .vbs - .wsf condition: selection falsepositives: - Rare legitimate usage of some of the extensions mentioned in the rule level: high
Near-miss passage: Sigma rule: Detect the creation of a service with a service binary located in a suspicious directory. Logsource: windows / registry_set. Rule: title: Service Binary in Suspicious Folder id: a07f0359-4c90-4dc4-a681-8ffea40b4f47 related: - id: c0abc838-36b0-47c9-b3b3-a90c39455382 type: obsolete status: test description: Detect the creation of a service with a service binary located in a suspicious directory references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: Florian Roth (Nextron Systems), frack113 date: 2022-05-02 modified: 2025-10-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_service_start: TargetObject|startswith: HKLM\System\CurrentControlSet\Services\ TargetObject|endswith: \Start Image|contains: - \Users\Public\ - \Perflogs\ - \ADMIN$\ - \Temp\ Details: - DWORD (0x00000000) - DWORD (0x00000001) - DWORD (0x00000002) selection_service_imagepath: TargetObject|startswith: HKLM\System\CurrentControlSet\Services\ TargetObject|endswith: \ImagePath Details|contains: - \Users\Public\ - \Perflogs\ - \ADMIN$\ - \Temp\ filter_optional_avast: Image|contains|all: - \Common Files\ - \Temp\ filter_optional_mbamservice: TargetObject|endswith: \CurrentControlSet\Services\MBAMInstallerService\ImagePath Details|endswith: \AppData\Local\Temp\MBAMInstallerService.exe" Image: C:\Windows\system32\services.exe condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: high