Startup Folder Persistence by Suspicious Processes

This detection rule identifies suspicious processes writing to the Windows Startup folder, a common persistence mechanism. The rule focuses on detecting file creation or modification within the Startup folder by processes such as cmd.exe, powershell.exe, wmic.exe, mshta.exe, pwsh.exe, cscript.exe, wscript.exe, regsvr32.exe, RegAsm.exe, rundll32.exe, EQNEDT32.EXE, WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, MSPUB.EXE, MSACCESS.EXE, iexplore.exe, and InstallUtil.exe. These processes, while legitimate, are often abused by adversaries to establish persistence. The rule is designed to detect this behavior across various Windows environments and utilizes EQL for efficient detection. The detection logic was last updated on April 7, 2026. This activity is a common persistence technique, and detecting it can prevent attackers from maintaining long-term access to compromised systems.

Attack Chain

1. An attacker gains initial access to a Windows system, often through methods like phishing or exploiting vulnerabilities.
2. The attacker uses a commonly abused process, such as powershell.exe or cmd.exe, to write a malicious file to the Startup folder.
3. The malicious file could be a script, executable, or shortcut designed to execute upon user login or system startup.
4. The attacker leverages the Startup folder to automatically execute their malicious payload without user interaction.
5. Upon the next user login or system startup, the malicious file is executed by explorer.exe, initiating the attacker's payload.
6. The payload establishes a connection to a command-and-control server for further instructions and exfiltration.
7. The attacker gains persistent access to the compromised system, allowing them to perform malicious activities such as data theft or lateral movement.

Impact

A successful attack can lead to persistent access for the attacker, enabling them to perform various malicious activities such as data exfiltration, deployment of ransomware, or further compromise of the network. The impact can range from data breaches and financial loss to disruption of business operations. While the number of victims is variable, the sectors most commonly targeted include government, finance, and technology.

Recommendation

• Deploy the Sigma rules provided below to your SIEM and tune them for your environment to detect suspicious processes writing to the Startup folder.
• Enable Sysmon file creation and modification logging to capture the necessary events for the provided Sigma rules to function.
• Investigate any alerts generated by these rules to determine if the activity is legitimate or malicious as outlined in the rule's documentation.
• Monitor process execution events for processes such as cmd.exe, powershell.exe, wmic.exe and others writing files to the paths "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*" and "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\*".