Possible Persistence Attempt Through ErrorHandler.Cmd (via file_event)

title: Possible Persistence Attempt Through ErrorHandler.Cmd (via file_event)
id: 212b630f-d2dc-5a7f-9d32-37601d6fc2c7
status: stable
description: This rule detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.
references:
    - https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
    - https://github.com/last-byte/PersistenceSniper
author: Huntrule Team
date: 2026-05-18
tags:
    - attack.persistence
    - attack.t1546
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\WINDOWS\Setup\Scripts\ErrorHandler.cmd'
    condition: selection
falsepositives:
    - Unknown
level: medium