{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/multiple/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Multiple"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["persistence","windows","startup-folder"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eAttackers commonly abuse the Windows Startup folder as a persistence mechanism. By placing executable files, scripts, or shortcuts within this directory, they can ensure that their malicious code runs automatically whenever a user logs in or the system boots. This technique allows adversaries to maintain a foothold on compromised systems, enabling them to execute arbitrary commands, deploy malware, or steal sensitive information. This activity is significant because it bypasses traditional security measures that focus on initial infection vectors, instead relying on a legitimate system functionality to achieve persistence. The analytic leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. Several malware families, including XWorm, Chaos Ransomware, NjRAT, Crypto Stealer, Gozi Malware, Quasar RAT, RedLine Stealer, Interlock Ransomware, APT37 Rustonotto and FadeStealer, PromptFlux, and BlankGrabber Stealer, are known to utilize this technique.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is gained through various means, such as exploiting vulnerabilities, using compromised credentials, or social engineering.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the location of the Startup folder, typically \u003ccode\u003e%AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\u003c/code\u003e or \u003ccode\u003e%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eA malicious executable, script (e.g., PowerShell, VBScript), or shortcut file is created in the Startup folder.\u003c/li\u003e\n\u003cli\u003eThe attacker may use techniques to hide or obfuscate the malicious file, such as using a misleading name or disguising it as a legitimate system file.\u003c/li\u003e\n\u003cli\u003eUpon system boot or user logon, the operating system automatically executes the file placed in the Startup folder.\u003c/li\u003e\n\u003cli\u003eThe malicious code executes, potentially downloading and installing additional malware, establishing a command and control (C2) connection, or performing other malicious activities.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains persistent access to the compromised system, allowing them to remotely control the system, steal data, or perform other malicious actions.\u003c/li\u003e\n\u003cli\u003eThe attacker can deploy ransomware or exfiltrate sensitive information.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to maintain long-term access to compromised systems, even after reboots. This persistence enables them to conduct a variety of malicious activities, including data theft, ransomware deployment, and lateral movement within the network. This impacts confidentiality, integrity, and availability. Organizations across various sectors are vulnerable to this technique, especially those with lax security practices or outdated systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable Sysmon EventID 11 logging to monitor file creation events on endpoints, allowing the rules below to function correctly.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to your SIEM to detect suspicious file creation activity in the Windows Startup folder and tune for your environment.\u003c/li\u003e\n\u003cli\u003eInvestigate any alerts generated by the Sigma rules, focusing on identifying the processes responsible for creating files in the Startup folder.\u003c/li\u003e\n\u003cli\u003eMonitor the MITRE ATT\u0026amp;CK technique T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) to stay informed about new threats and detection methods.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-03-startup-persistence/","summary":"Adversaries use the Windows Startup folder to establish persistence by creating malicious files that execute automatically upon system boot or user logon.","title":"Windows Startup Folder Persistence","url":"https://feed.craftedsignal.io/briefs/2024-01-03-startup-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Multiple","version":"https://jsonfeed.org/version/1.1"}