huntrule

Windows Persistence File Drop: ErrorHandler.cmd in C:\WINDOWS\Setup\Scripts\

Alerts on writing ErrorHandler.cmd to C:\WINDOWS\Setup\Scripts\, a persistence-relevant location on Windows.

FreeUnreviewedSigmamediumv1
title: "Windows Persistence File Drop: ErrorHandler.cmd in C:\\WINDOWS\\Setup\\Scripts\\"
id: a6f3c76e-6916-44de-a676-e12ff0eb9af3
status: test
description: This rule flags creation of a Windows batch file named ErrorHandler.cmd within C:\WINDOWS\Setup\Scripts\, which can be used to establish persistence. An attacker could leverage this location so the script is invoked by setup-related components when they fail to run. The detection relies on file creation or file event telemetry that includes the target filename/path.
references:
  - https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
  - https://github.com/last-byte/PersistenceSniper
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_errorhandler_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-09
modified: 2022-12-19
tags:
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \WINDOWS\Setup\Scripts\ErrorHandler.cmd
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 15904280-565c-4b73-9303-3291f964e7f9
    type: derived

What it detects

This rule flags creation of a Windows batch file named ErrorHandler.cmd within C:\WINDOWS\Setup\Scripts\, which can be used to establish persistence. An attacker could leverage this location so the script is invoked by setup-related components when they fail to run. The detection relies on file creation or file event telemetry that includes the target filename/path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.