huntrule

Windows Startup Folder File Creation with Suspicious Script/Executable Extensions

Alerts on creation of startup-folder files with script/executable extensions commonly used for logon persistence on Windows.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-08-10
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags file events where the target path is within the Windows Startup folder and the filename ends with extensions commonly used for scripts or executable content (such as .ps1, .vbs, .js, .bat, .cmd, .hta, .scr, and others). Startup folder writes can enable persistence because items placed there may run automatically when the user logs in. It relies on Windows file event telemetry capturing the TargetFilename path and extension.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Uncommon Executable Written to Startup Folder by WinRAR via CVE-2025-8088 Path Traversal (via file_event)
Suspicious Run Key Persistence Referencing PowerShell Script via registry_set
Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)
Malicious PXA Stealer Persistence via Windows Update Service Run Key (via registry_set)
Suspicious NetSupport client32 Persistence via Run Key from ProgramData
Suspicious Run Key Persistence Named NvidiaDriverUpdate (via registry_set)
Suspicious HijackLoader Component Execution via ClearFake
Suspicious HTA File Dropped into Startup Folder
Suspicious Registry Run Key Referencing Public Libraries Folder (via registry_set)
Windows Startup Folder File Creation with Suspicious Script/Executable Extensions
Pivot detection · T1547.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.