Startup Folder File Write

Severity: medium
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source: upstream

A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Event coverage

Provider	Event ID	Title
Sysmon	11	FileCreate

Stages and Predicates

Stage 1: `selection`

TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\StartUp'

Stage 2: `not 1 of filter_main_update`

or:
Image: 'C:\Windows\System32\wuauclt.exe'
Image: 'C:\Windows\uus\ARM64\wuaucltcore.exe'
TargetFilename|startswith: 'C:\$WINDOWS.~BT\NewOS\'
TargetFilename|startswith: 'C:\$WinREAgent\Scratch\Mount\'

Stage 3: `not 1 of filter_optional_onenote`

Image|endswith: '\ONENOTE.EXE'
TargetFilename|endswith: '\Send to OneNote.lnk'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\ONENOTE.EXE` corpus 3 (sigma 3)
`Image`	eq	`C:\Windows\System32\wuauclt.exe` corpus 3 (sigma 3) `C:\Windows\uus\ARM64\wuaucltcore.exe`
`TargetFilename`	ends_with	`\Send to OneNote.lnk`
`TargetFilename`	match	`\Microsoft\Windows\Start Menu\Programs\StartUp`
`TargetFilename`	starts_with	`C:\$WINDOWS.~BT\NewOS\` corpus 2 (sigma 2) `C:\$WinREAgent\Scratch\Mount\`