Windows Persistence Attempt via ErrorHandler.cmd in C:\WINDOWS\Setup\Scripts\
Alerts on writing ErrorHandler.cmd to C:\WINDOWS\Setup\Scripts\, a persistence-relevant location on Windows.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-09
- Updated
- 2026-07-31
What it detects
This rule flags creation or presence of a file named ErrorHandler.cmd under C:\WINDOWS\Setup\Scripts\ on Windows. Attackers may use this location to influence execution behavior when setup or related tools under C:\WINDOWS\System32\oobe\ encounter failures. It relies on file system event telemetry capturing the target filename and its full path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-persistence-file-drop-errorhandler-cmd-in-c-windows-setup-scripts-15904280
title: Windows Persistence Attempt via ErrorHandler.cmd in C:\WINDOWS\Setup\Scripts\
id: a6f3c76e-6916-44de-a676-e12ff0eb9af3
status: test
description: This rule flags creation or presence of a file named ErrorHandler.cmd under C:\WINDOWS\Setup\Scripts\ on Windows. Attackers may use this location to influence execution behavior when setup or related tools under C:\WINDOWS\System32\oobe\ encounter failures. It relies on file system event telemetry capturing the target filename and its full path.
references:
- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
- https://github.com/last-byte/PersistenceSniper
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_errorhandler_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-09
modified: 2022-12-19
tags:
- attack.persistence
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: \WINDOWS\Setup\Scripts\ErrorHandler.cmd
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 15904280-565c-4b73-9303-3291f964e7f9
type: derived