Startup-Folder - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/startup-folder/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 23 Jan 2024 12:00:00 +0000Detection of Persistent Scripts in the Startup Directoryhttps://feed.craftedsignal.io/briefs/2024-01-startup-folder-persistence/Tue, 23 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-startup-folder-persistence/This rule identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder, enabling adversaries to maintain persistence by placing malicious scripts or shortcuts in the Windows Startup folder, which are then executed during account logon.Attackers may establish persistence on a system by placing malicious scripts or shortcuts in the Windows Startup folder. This folder contains programs that are executed during account logon, without user interaction. This technique allows adversaries to automatically execute malicious code each time a user logs in. The rule detects the creation of script files (e.g., .vbs, .js, .ps1) within the Startup folder, as well as script engines (wscript.exe, cscript.exe) creating files within this directory. The monitored file extensions include vbs, vbe, wsh, wsf, js, jse, sct, hta, ps1, bat, and cmd. Successful exploitation can lead to persistent malware infections, unauthorized access, and further compromise of the system.

Attack Chain

  1. An attacker gains initial access to the target system through various means (e.g., phishing, exploitation of a vulnerability).
  2. The attacker identifies the Startup folder locations: C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ and C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\.
  3. The attacker crafts a malicious script (e.g., PowerShell script, VBScript, JavaScript).
  4. The attacker uses a script engine (e.g., wscript.exe, cscript.exe) or another process to create or modify a file with a malicious script, within one of the Startup folders.
  5. Alternatively, the attacker directly copies a malicious script file into the Startup folder.
  6. The system is rebooted, or the user logs off and logs back on.
  7. The malicious script is automatically executed during the logon process.
  8. The attacker achieves persistence, enabling them to execute arbitrary commands, install malware, or perform other malicious activities on the system.

Impact

Successful exploitation allows for persistent malware infections, unauthorized access, and further compromise of the system. Attackers can use this persistence to maintain access to a compromised system even after reboots or credential changes. This can lead to data theft, system disruption, or further propagation of the attack within the network.

Recommendation

  • Deploy the Sigma rule "Detect Script Creation in Startup Folder" to your SIEM and tune for your environment based on the file_event and process_creation log sources.
  • Enable Sysmon file creation and process creation logging on Windows endpoints to collect the necessary event data for the Sigma rules above.
  • Investigate any alerts generated by the Sigma rules above, focusing on unusual or unexpected script activity in the Startup folder.
  • Consider implementing application control policies to restrict the execution of unauthorized scripts and executables in the Startup folder.
]]>mediumadvisorypersistencestartup-folderwindowsmalwareStartup Folder Persistence by Suspicious Processeshttps://feed.craftedsignal.io/briefs/2024-01-startup-persistence/Tue, 02 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-startup-persistence/This rule identifies files written to or modified in the startup folder by commonly abused processes on Windows systems, a technique adversaries use to maintain persistence by automatically executing malicious programs upon user login or system startup.This detection rule identifies suspicious processes writing to the Windows Startup folder, a common persistence mechanism. The rule focuses on detecting file creation or modification within the Startup folder by processes such as cmd.exe, powershell.exe, wmic.exe, mshta.exe, pwsh.exe, cscript.exe, wscript.exe, regsvr32.exe, RegAsm.exe, rundll32.exe, EQNEDT32.EXE, WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE, MSPUB.EXE, MSACCESS.EXE, iexplore.exe, and InstallUtil.exe. These processes, while legitimate, are often abused by adversaries to establish persistence. The rule is designed to detect this behavior across various Windows environments and utilizes EQL for efficient detection. The detection logic was last updated on April 7, 2026. This activity is a common persistence technique, and detecting it can prevent attackers from maintaining long-term access to compromised systems.

Attack Chain

  1. An attacker gains initial access to a Windows system, often through methods like phishing or exploiting vulnerabilities.
  2. The attacker uses a commonly abused process, such as powershell.exe or cmd.exe, to write a malicious file to the Startup folder.
  3. The malicious file could be a script, executable, or shortcut designed to execute upon user login or system startup.
  4. The attacker leverages the Startup folder to automatically execute their malicious payload without user interaction.
  5. Upon the next user login or system startup, the malicious file is executed by explorer.exe, initiating the attacker's payload.
  6. The payload establishes a connection to a command-and-control server for further instructions and exfiltration.
  7. The attacker gains persistent access to the compromised system, allowing them to perform malicious activities such as data theft or lateral movement.

Impact

A successful attack can lead to persistent access for the attacker, enabling them to perform various malicious activities such as data exfiltration, deployment of ransomware, or further compromise of the network. The impact can range from data breaches and financial loss to disruption of business operations. While the number of victims is variable, the sectors most commonly targeted include government, finance, and technology.

Recommendation

  • Deploy the Sigma rules provided below to your SIEM and tune them for your environment to detect suspicious processes writing to the Startup folder.
  • Enable Sysmon file creation and modification logging to capture the necessary events for the provided Sigma rules to function.
  • Investigate any alerts generated by these rules to determine if the activity is legitimate or malicious as outlined in the rule's documentation.
  • Monitor process execution events for processes such as cmd.exe, powershell.exe, wmic.exe and others writing files to the paths "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*" and "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\*".
]]>mediumadvisorypersistencestartup-folderwindows