Windows Startup Folder File Creation with Suspicious Script/Executable Extensions
Alerts on creation of startup-folder files with script/executable extensions commonly used for logon persistence on Windows.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-10
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file events where the target path is within the Windows Startup folder and the filename ends with extensions commonly used for scripts or executable content (such as .ps1, .vbs, .js, .bat, .cmd, .hta, .scr, and others). Startup folder writes can enable persistence because items placed there may run automatically when the user logs in. It relies on Windows file event telemetry capturing the TargetFilename path and extension.
Reporting behind it
- github.comhttps://github.com/last-byte/PersistenceSniper
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Startup Folder File Creation with Suspicious Script/Executable Extensions
id: 88e76f33-c85c-4e8f-98a6-bc9e1598b824
related:
- id: 2aa0a6b4-a865-495b-ab51-c28249537b75
type: similar
- id: 28208707-fe31-437f-9a7f-4b1108b94d2e
type: derived
status: test
description: This rule flags file events where the target path is within the Windows Startup folder and the filename ends with extensions commonly used for scripts or executable content (such as .ps1, .vbs, .js, .bat, .cmd, .hta, .scr, and others). Startup folder writes can enable persistence because items placed there may run automatically when the user logs in. It relies on Windows file event telemetry capturing the TargetFilename path and extension.
references:
- https://github.com/last-byte/PersistenceSniper
- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
- https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-08-10
modified: 2025-10-12
tags:
- attack.privilege-escalation
- attack.execution
- attack.t1204.002
- attack.persistence
- attack.t1547.001
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: \Windows\Start Menu\Programs\Startup\
TargetFilename|endswith:
- .bat
- .cmd
- .dll
- .hta
- .jar
- .js
- .jse
- .msi
- .ps1
- .psd1
- .psm1
- .scr
- .url
- .vba
- .vbe
- .vbs
- .wsf
condition: selection
falsepositives:
- Rare legitimate usage of some of the extensions mentioned in the rule
level: high
license: DRL-1.1