Windows Startup Directory File Writes for Persistence
Alerts on file writes into the Windows Startup folder that may indicate user-level persistence.
- Product
- windows
- Category
- file_event
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
- Published
- 2020-05-02
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file creation events where the target path contains the Windows Startup directory under the Start Menu Programs StartUp. Attackers commonly use this location to establish persistence by placing shortcut or program files that execute on user logon. Detection relies on Windows file event telemetry that provides the full TargetFilename and the creating process Image path for event filtering.
Reporting behind it
- github.comhttps://github.com/OTRF/detection-hackathon-apt29/issues/12
- github.comhttps://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Startup Directory File Writes for Persistence
id: c1bc8dda-d56b-4d0b-a023-41018f8c5e6b
related:
- id: 28208707-fe31-437f-9a7f-4b1108b94d2e
type: similar
- id: 2aa0a6b4-a865-495b-ab51-c28249537b75
type: derived
status: test
description: This rule flags file creation events where the target path contains the Windows Startup directory under the Start Menu Programs StartUp. Attackers commonly use this location to establish persistence by placing shortcut or program files that execute on user logon. Detection relies on Windows file event telemetry that provides the full TargetFilename and the creating process Image path for event filtering.
references:
- https://github.com/OTRF/detection-hackathon-apt29/issues/12
- https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_startup_folder_file_write.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-05-02
modified: 2025-12-03
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\StartUp
filter_main_update:
- Image:
- C:\Windows\System32\wuauclt.exe
- C:\Windows\uus\ARM64\wuaucltcore.exe
- TargetFilename|startswith:
- C:\$WINDOWS.~BT\NewOS\
- C:\$WinREAgent\Scratch\Mount\
filter_optional_onenote:
Image|endswith: \ONENOTE.EXE
TargetFilename|endswith: \Send to OneNote.lnk
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate
level: medium
license: DRL-1.1