Windows Startup Folder File Creation With Suspicious Script/Executable Extensions

Alerts on creation of startup-folder files with script/executable extensions commonly used for logon persistence on Windows.

FreeUnreviewedSigmahighv1

windows-startup-folder-file-creation-with-suspicious-script-executable-extension-28208707

title: Windows Startup Folder File Creation With Suspicious Script/Executable Extensions
id: 88e76f33-c85c-4e8f-98a6-bc9e1598b824
related:
  - id: 2aa0a6b4-a865-495b-ab51-c28249537b75
    type: similar
  - id: 28208707-fe31-437f-9a7f-4b1108b94d2e
    type: derived
status: test
description: This rule flags file creation events where the target path is within the Windows Startup folder and the filename ends with commonly abused script or executable-related extensions. Startup folder items run automatically on user logon, which attackers can use to establish persistence without additional exploit steps. The detection relies on Windows file event telemetry that includes the created file’s full path/filename and extension.
references:
  - https://github.com/last-byte/PersistenceSniper
  - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
  - https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-08-10
modified: 2025-10-12
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.t1204.002
  - attack.persistence
  - attack.t1547.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \Windows\Start Menu\Programs\Startup\
    TargetFilename|endswith:
      - .bat
      - .cmd
      - .dll
      - .hta
      - .jar
      - .js
      - .jse
      - .msi
      - .ps1
      - .psd1
      - .psm1
      - .scr
      - .url
      - .vba
      - .vbe
      - .vbs
      - .wsf
  condition: selection
falsepositives:
  - Rare legitimate usage of some of the extensions mentioned in the rule
level: high
license: DRL-1.1

What it detects

This rule flags file creation events where the target path is within the Windows Startup folder and the filename ends with commonly abused script or executable-related extensions. Startup folder items run automatically on user logon, which attackers can use to establish persistence without additional exploit steps. The detection relies on Windows file event telemetry that includes the created file’s full path/filename and extension.

Known false positives

Rare legitimate usage of some of the extensions mentioned in the rule

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.