Detection of Persistent Scripts in the Startup Directory

Attackers may establish persistence on a system by placing malicious scripts or shortcuts in the Windows Startup folder. This folder contains programs that are executed during account logon, without user interaction. This technique allows adversaries to automatically execute malicious code each time a user logs in. The rule detects the creation of script files (e.g., .vbs, .js, .ps1) within the Startup folder, as well as script engines (wscript.exe, cscript.exe) creating files within this directory. The monitored file extensions include vbs, vbe, wsh, wsf, js, jse, sct, hta, ps1, bat, and cmd. Successful exploitation can lead to persistent malware infections, unauthorized access, and further compromise of the system.

Attack Chain

1. An attacker gains initial access to the target system through various means (e.g., phishing, exploitation of a vulnerability).
2. The attacker identifies the Startup folder locations: C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ and C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\.
3. The attacker crafts a malicious script (e.g., PowerShell script, VBScript, JavaScript).
4. The attacker uses a script engine (e.g., wscript.exe, cscript.exe) or another process to create or modify a file with a malicious script, within one of the Startup folders.
5. Alternatively, the attacker directly copies a malicious script file into the Startup folder.
6. The system is rebooted, or the user logs off and logs back on.
7. The malicious script is automatically executed during the logon process.
8. The attacker achieves persistence, enabling them to execute arbitrary commands, install malware, or perform other malicious activities on the system.

Impact

Successful exploitation allows for persistent malware infections, unauthorized access, and further compromise of the system. Attackers can use this persistence to maintain access to a compromised system even after reboots or credential changes. This can lead to data theft, system disruption, or further propagation of the attack within the network.

Recommendation

• Deploy the Sigma rule "Detect Script Creation in Startup Folder" to your SIEM and tune for your environment based on the file_event and process_creation log sources.
• Enable Sysmon file creation and process creation logging on Windows endpoints to collect the necessary event data for the Sigma rules above.
• Investigate any alerts generated by the Sigma rules above, focusing on unusual or unexpected script activity in the Startup folder.
• Consider implementing application control policies to restrict the execution of unauthorized scripts and executables in the Startup folder.