{"id":"2aa0a6b4-a865-495b-ab51-c28249537b75","title":"Startup Folder File Write","description":"A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-05-02","modified":"2025-12-03","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.001"],"technique_ids":["T1547.001"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate"],"references":["https://github.com/OTRF/detection-hackathon-apt29/issues/12","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md"],"source_path":"rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml","source_sha256":"651a2ccddb72c7e95453a2e35d3c3c15a58d3fcb610cd085fa9b539ae1408e9b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Startup Folder File Write\nid: 2aa0a6b4-a865-495b-ab51-c28249537b75\nrelated:\n    - id: 28208707-fe31-437f-9a7f-4b1108b94d2e\n      type: similar\nstatus: test\ndescription: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.\nreferences:\n    - https://github.com/OTRF/detection-hackathon-apt29/issues/12\n    - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2020-05-02\nmodified: 2025-12-03\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.001\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|contains: '\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp'\n    filter_main_update:\n        - Image:\n              - 'C:\\Windows\\System32\\wuauclt.exe'\n              - 'C:\\Windows\\uus\\ARM64\\wuaucltcore.exe'\n        - TargetFilename|startswith:\n              - 'C:\\$WINDOWS.~BT\\NewOS\\'\n              - 'C:\\$WinREAgent\\Scratch\\Mount\\'\n    filter_optional_onenote:\n        Image|endswith: '\\ONENOTE.EXE'\n        TargetFilename|endswith: '\\Send to OneNote.lnk'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.001","id":"T1547.001","name":"Registry Run Keys / Startup Folder","page":"techniques/enterprise/T1547.001/"}],"data_path":"data/detection-rules/2aa0a6b4-a865-495b-ab51-c28249537b75.json","kind":"sigma"}