Windows PowerShell Creating Startup Shortcut .lnk Files for Persistence

Detects PowerShell writing .lnk files into the Windows Startup folder, a common persistence mechanism.

FreeUnreviewedSigmahighv1

windows-powershell-creating-startup-shortcut-lnk-files-for-persistence-92fa78e7

title: Windows PowerShell Creating Startup Shortcut .lnk Files for Persistence
id: c142a052-871b-445e-b5d3-a57811aca045
status: test
description: This rule flags Windows events where PowerShell (powershell.exe/pwsh.exe) writes shortcut files in the Startup folder path. Attackers often use .lnk shortcuts in startup locations to achieve persistence by triggering payloads on user logon. The detection relies on file event telemetry capturing the PowerShell image and the created/target .lnk filename under the Startup directory.
references:
  - https://redcanary.com/blog/intelligence-insights-october-2021/
  - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml
author: Christopher Peacock '@securepeacock', SCYTHE, Huntrule Team
date: 2021-10-24
modified: 2023-02-23
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetFilename|contains: \start menu\programs\startup\
    TargetFilename|endswith: .lnk
  condition: selection
falsepositives:
  - Depending on your environment accepted applications may leverage this at times. It is recommended to search for anomalies inidicative of malware.
level: high
license: DRL-1.1
related:
  - id: 92fa78e7-4d39-45f1-91a3-8b23f3f1088d
    type: derived

What it detects

This rule flags Windows events where PowerShell (powershell.exe/pwsh.exe) writes shortcut files in the Startup folder path. Attackers often use .lnk shortcuts in startup locations to achieve persistence by triggering payloads on user logon. The detection relies on file event telemetry capturing the PowerShell image and the created/target .lnk filename under the Startup directory.

Known false positives

Depending on your environment accepted applications may leverage this at times. It is recommended to search for anomalies inidicative of malware.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.