huntrule

Windows Persistence Attempt via ErrorHandler.cmd in C:\WINDOWS\Setup\Scripts\

Alerts on writing ErrorHandler.cmd to C:\WINDOWS\Setup\Scripts\, a persistence-relevant location on Windows.

FreeReviewedSigma · Medium · v2
Product
windows
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-08-09
Updated
2026-07-31
AnalysisDetection
title: Windows Persistence Attempt via ErrorHandler.cmd in C:\WINDOWS\Setup\Scripts\
id: a6f3c76e-6916-44de-a676-e12ff0eb9af3
status: test
description: This rule flags creation or presence of a file named ErrorHandler.cmd under C:\WINDOWS\Setup\Scripts\ on Windows. Attackers may use this location to influence execution behavior when setup or related tools under C:\WINDOWS\System32\oobe\ encounter failures. It relies on file system event telemetry capturing the target filename and its full path.
references:
  - https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
  - https://github.com/last-byte/PersistenceSniper
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_errorhandler_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-09
modified: 2022-12-19
tags:
  - attack.persistence
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \WINDOWS\Setup\Scripts\ErrorHandler.cmd
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 15904280-565c-4b73-9303-3291f964e7f9
    type: derived